CVE catalog
CVE-2024-22018
nodejs: CVE-2024-22018
- Severity
- Low · CVSS 2.9
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.46% · Oct 25, 2026
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nodejs | sid | 24.22.1+dfsg+~cs24.19.2-1 | fixed |
| Debian | nodejs | forky | 24.21.0+dfsg+~cs24.13.4-1 | fixed |
| Debian | nodejs | trixie | 20.19.2+dfsg-1+deb13u2 | fixed |
| Debian | nodejs | trixie-security | 20.19.2+dfsg-1+deb13u3 | fixed |
| Debian | nodejs | bookworm | 18.20.4+dfsg-1~deb12u2 | not affected |
| Debian | nodejs | bookworm-security | 18.20.4+dfsg-1~deb12u3 | not affected |
| Alpine | nodejs | 3.19 | 20.15.1-r0 | fixed |
| Alpine | nodejs | 3.20 | 20.15.1-r0 | fixed |
| Alpine | nodejs | 3.21 | 20.15.1-r0 | fixed |
| Alpine | nodejs | 3.22 | 20.15.1-r0 | fixed |
| Alpine | nodejs | 3.23 | 20.15.1-r0 | fixed |
| Alpine | nodejs | 3.24 | 20.15.1-r0 | fixed |
| Ubuntu | nodejs | pro | 12.22.5~dfsg-5ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.7~dfsg-2ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.7~dfsg-2ubuntu3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu2 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.2 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.4 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.5 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.6 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.6+esm2 | vulnerable |
| Ubuntu | nodejs | 24.04 | 18.13.0+dfsg1-1ubuntu2 | vulnerable |
| Ubuntu | nodejs | 24.04 | 18.19.1+dfsg-2ubuntu4 | vulnerable |
| Ubuntu | nodejs | 24.04 | 18.19.1+dfsg-6ubuntu1 | vulnerable |
| Ubuntu | nodejs | 24.04 | 18.19.1+dfsg-6ubuntu2 | vulnerable |
| Ubuntu | nodejs | 24.04 | 18.19.1+dfsg-6ubuntu5 | vulnerable |
| Suse | nodejs20 | linux enterprise module for web and scripting 15 sp6 | 20.15.1-150600.3.3.2 | fixed |
| Opensuse | nodejs20 | leap 15.6 | 20.15.1-150600.3.3.2 | fixed |
| Suse | nodejs20 | linux enterprise module for web and scripting 15 sp5 | 20.15.1-150500.11.12.2 | fixed |
| Opensuse | nodejs20 | leap 15.5 | 20.15.1-150500.11.12.2 | fixed |
| Opensuse | nodejs20 | tumbleweed | 20.15.1-1.1 | fixed |
| Opensuse | nodejs22 | tumbleweed | 22.10.0-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nodejs | source | sid | 20.15.1+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | nodejs | source | forky | 20.15.1+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | nodejs | source | trixie | 20.15.1+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | nodejs | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Alpine | nodejs | apk | 3.19 | 20.15.1-r0 | Not reported | ALPINE-CVE-2024-22018 | Not reported |
| Alpine | nodejs | apk | 3.20 | 20.15.1-r0 | Not reported | ALPINE-CVE-2024-22018 | Not reported |
| Alpine | nodejs | apk | 3.21 | 20.15.1-r0 | Not reported | ALPINE-CVE-2024-22018 | Not reported |
| Alpine | nodejs | apk | 3.22 | 20.15.1-r0 | Not reported | ALPINE-CVE-2024-22018 | Not reported |
| Alpine | nodejs | apk | 3.23 | 20.15.1-r0 | Not reported | ALPINE-CVE-2024-22018 | Not reported |
| Alpine | nodejs | apk | 3.24 | 20.15.1-r0 | Not reported | ALPINE-CVE-2024-22018 | Not reported |
| Suse | nodejs20 | rpm | linux enterprise module for web and scripting 15 sp6 | 20.15.1-150600.3.3.2 | Not reported | SUSE-SU-2024:2574-1 | Not reported |
| Opensuse | nodejs20 | rpm | leap 15.6 | 20.15.1-150600.3.3.2 | Not reported | SUSE-SU-2024:2574-1 | Not reported |
| Suse | nodejs20 | rpm | linux enterprise module for web and scripting 15 sp5 | 20.15.1-150500.11.12.2 | Not reported | SUSE-SU-2024:2543-1 | Not reported |
| Opensuse | nodejs20 | rpm | leap 15.5 | 20.15.1-150500.11.12.2 | Not reported | SUSE-SU-2024:2543-1 | Not reported |
| Opensuse | nodejs20 | rpm | tumbleweed | 20.15.1-1.1 | Not reported | OPENSUSE-SU-2024:14214-1 | Not reported |
| Opensuse | nodejs22 | rpm | tumbleweed | 22.10.0-1.1 | Not reported | OPENSUSE-SU-2024:14435-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libnode108]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· arm64 · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
- [libnode-dev]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· arm64 · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
- [nodejs]Unknown
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· arm64 · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
- [nodejs-doc]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· all · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· all · bookwormNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· all · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2· all · bookworm-securityNot affected
dsa · nodejs · debian · bookworm
[Debian 13 (Trixie)]
- [libnode115]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
- [libnode-dev]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
- [nodejs]Unknown
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
- [nodejs-doc]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· all · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixieFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixie-security · Historical versionFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· all · trixie-securityFixed · Fixed:
20.15.1+dfsg-1dsa · nodejs · debian · 13
Observed:
References
- [https://access.redhat.com/errata/RHSA-2024:5815]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_5814.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2024-22018]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-22018]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2543-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2574-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-22018]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14214-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14435-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-22018]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1548.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]