Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123829
Permission-model filename leak in Node.js recursive watch
- CVSS 3.0
- 2.5 low
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
On macOS and Windows, Node.js recursive fs.watch() and fs.promises.watch() check the permission model's read grant only on the watched root. Code already running under --permission with a read grant on that directory can learn names and timing of files and directories at any depth that it is not allowed to read, but not file contents. Another actor must create those files under the watched directory. Node.js 26.x, 24.x, and 22.x are affected.
What to do: Apply the Node.js project's update for CVE-2026-123829; fixed versions are not listed here.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-200
- Vector
- CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N