An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required…

Description

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

Scores

EPSS (exploitation in 30 days)

0.14% · top 96% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.

Weakness

• CWE-862 Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

• nodejs · node

  • affected 20.20.1 – ≤ 20.20.1
  • affected 22.22.1 – ≤ 22.22.1
  • affected 24.14.0 – ≤ 24.14.0
  • affected 25.8.1 – ≤ 25.8.1

References (1)

• https://nodejs.org/en/blog/vulnerability/march-2026-security-releases (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-21716](https://trackcve.app/badge/CVE-2026-21716.svg)](https://trackcve.app/cve/CVE-2026-21716)

Record last updated 31 Mar 2026, 14:27 UTC.