Cyber Resilience

CVE-2024-21890

Nodejs Node.Js 20.0.0 – 20.11.1

Published
20 February 2024
Modified
17 June 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0095 58th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2024-21890 is a medium-severity an unspecified weakness vulnerability in Nodejs Node.Js. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This…

more

misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CWE(s)
NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2025-59466Same product: Nodejs Node.Js
CVE-2026-48928Same product: Nodejs Node.Js
CVE-2026-48933Same product: Nodejs Node.Js
CVE-2026-48936Same product: Nodejs Node.Js
CVE-2026-21636Same product: Nodejs Node.Js
CVE-2023-23918Same product: Nodejs Node.Js
CVE-2025-59464Same product: Nodejs Node.Js
CVE-2023-23919Same product: Nodejs Node.Js
CVE-2023-32002Same product: Nodejs Node.Js
CVE-2023-32005Same product: Nodejs Node.Js

Affected Assets

nodejs
node.js
20.0.0 — 20.11.1 · 21.0.0 — 21.6.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References