Security Resilience

CVE-2024-21890

Nodejs Node.Js 20.0.0 – 20.11.1

Published
20 February 2024
Modified
17 June 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0095 60th percentile
Risk Priority 54 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-21890 is a medium-severity an unspecified weakness vulnerability in Nodejs Node.Js. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 40% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This…

more

misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CWE(s)
NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2023-30586Same product: Nodejs Node.Js
CVE-2026-48930Same product: Nodejs Node.Js
CVE-2024-21891Same product: Nodejs Node.Js
CVE-2025-55132Same product: Nodejs Node.Js
CVE-2023-32005Same product: Nodejs Node.Js
CVE-2026-48618Same product: Nodejs Node.Js
CVE-2026-48928Same product: Nodejs Node.Js
CVE-2026-48934Same product: Nodejs Node.Js
CVE-2026-21637Same product: Nodejs Node.Js
CVE-2023-30590Same product: Nodejs Node.Js

Affected Assets

nodejs
node.js
20.0.0 — 20.11.1 · 21.0.0 — 21.6.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References