Node.js enforces a Permission Model that restricts file system access to processes running with the --allow-fs-read flag. However, the realpathSync.native() method is exempt from the required read permission checks, allowing local code running under restricted file system reads to verify the existence of files, resolve symlinks, and traverse paths outside the permitted directories. This flaw can reveal the structure of the file system, sensitive file names, and other details that should remain hidden, resulting in information disclosure.

The vulnerability affects Node.js versions 20.x, 22.x, 24.x, and 25.x when the Permission Model is enabled and --allow-fs-read is intentionally disabled. All processes running under these configurations that invoke fs.realpathSync.native() are susceptible.

The CVSS score of 3.3 indicates a low overall severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires code execution within a Node.js process that has been restricted by the Permission Model, implying an attacker would need local access to inject or run malicious JavaScript. The attack vector is inferred to be local, as the flaw does not expose a network-facing entry point.