CVE-2024-36137

lowpriority · track · 0EPSS 0.004 · 33 %ileDEEUNLRUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.40% (33rd) EPSS
CVSS 3.3 · low
Is it mine?
74 products
Check your exposure
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-22

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixednodejs-1:20.16.0-1.module+el9.4.0+22197+9e60f127.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-1:20.16.0-1.module+el9.4.0+22197+9e60f127.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-1:20.16.0-1.module+el9.4.0+22197+9e60f127.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-1:20.16.0-1.module+el9.4.0+22197+9e60f127.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-1:20.16.0-1.module+el9.4.0+22197+9e60f127.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debuginfo-1:20.16.0-1.module+el9.4.0+22197+9e60f127.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debuginfo-1:20.16.0-1.module+el9.4.0+22197+9e60f127.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debuginfo-1:20.16.0-1.module+el9.4.0+22197+9e60f127.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debuginfo-1:20.16.0-1.module+el9.4.0+22197+9e60f127.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debugsource-1:20.16.0-1.module+el9.4.0+22197+9e60f127.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debugsource-1:20.16.0-1.module+el9.4.0+22197+9e60f127.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debugsource-1:20.16.0-1.module+el9.4.0+22197+9e60f127.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-debugsource-1:20.16.0-1.module+el9.4.0+22197+9e60f127.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-devel-1:20.16.0-1.module+el9.4.0+22197+9e60f127.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-devel-1:20.16.0-1.module+el9.4.0+22197+9e60f127.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-devel-1:20.16.0-1.module+el9.4.0+22197+9e60f127.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-devel-1:20.16.0-1.module+el9.4.0+22197+9e60f127.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-docs-1:20.16.0-1.module+el9.4.0+22197+9e60f127.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-full-i18n-1:20.16.0-1.module+el9.4.0+22197+9e60f127.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-full-i18n-1:20.16.0-1.module+el9.4.0+22197+9e60f127.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-full-i18n-1:20.16.0-1.module+el9.4.0+22197+9e60f127.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-full-i18n-1:20.16.0-1.module+el9.4.0+22197+9e60f127.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-nodemon-0:3.0.1-1.module+el9.3.0.z+20478+84a9f781.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-nodemon-0:3.0.1-1.module+el9.3.0.z+20478+84a9f781.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-packaging-0:2021.06-4.module+el9.3.0+19518+63aad52d.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-packaging-0:2021.06-4.module+el9.3.0+19518+63aad52d.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednodejs-packaging-bundler-0:2021.06-4.module+el9.3.0+19518+63aad52d.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednpm-1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednpm-1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednpm-1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
  • Fixednpm-1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:5815
02

cvss

Technical severity, 0–10. One row per scoring source.

7.1
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.3–7.1

v3.03.3lowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU
v3.03.3lowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondary · support@hackerone.comexploitability 1.8 · impact 1.4
v3.13.9lowAV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.13.9lowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:Nsecondary · Red Hat Product Security US
v3.17.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:Hsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-264USCWE-275USCWE-732US
05

affected products (74)

Products and version ranges known to be affected.

showing 20 of 74
06

advisories (7)

Vendor and ecosystem advisories describing this.

  • NCSC-2024-0411Kwetsbaarheden verholpen in Oracle Database productenNL2024-10-17csaf · ncsc_nlNL

    Oracle heeft kwetsbaarheden verholpen in diverse Database producten en subsystemen, zoals de Core database, Application Express, Autonomous Health Framework, Essbase, GoldenGate, SQL Developer en Secure Backup.

  • NCSC-2025-0023Kwetsbaarheden verholpen in Oracle PeopleSoftNL2025-01-22csaf · ncsc_nlNL

    Oracle heeft meerdere kwetsbaarheden verholpen in Oracle PeopleSoft, specifiek in de versies 8.60, 8.61 en 9.2.

  • RHSA-2024:5815Red Hat Security Advisory: nodejs:20 security update2024-08-26csaf · redhat_csafUS

    An update for the nodejs:20 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2024-1548Node.js: Mehrere SchwachstellenDeutsch2024-07-08csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen oder um Sicherheitsmaßnahmen zu umgehen.

  • WID-SEC-W-2026-0843Node.js: Mehrere SchwachstellenDeutsch2026-03-24csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen.

  • BIT-node-2024-361372024-09-10vendor · osvUS

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

  • BIT-node-min-2024-361372024-12-16vendor · osvUS

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

07

also known as (6)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundncsc_nlredhat_csafNVDCVE.orgMITRE
published 2024-09-07modified 2026-06-17
09

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan