---
id: "CVE-2026-123829"
page: "https://infrastack.ai/live/CVE-2026-123829"
kind: "vulnerability"
aliases: ["CVE-2026-123829"]
title: "Node.js: recursive file watching leaks names of files it should not read"
severity: "low"
cvss: 2.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["macos", "node.js", "permission-model", "runtime", "windows"]
not_affected_if: ["linux", "managed-hosting", "no-permission-flag", "non-recursive-watch"]
published_at: "2026-11-11T19:17:32+00:00"
first_seen_at: "2026-11-11T19:28:45+00:00"
updated_at: "2026-11-11T19:30:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123829", "first_seen_at": "2026-11-11T19:28:45+00:00"}]
exploit_sources: []
---

# Node.js: recursive file watching leaks names of files it should not read

Link for people: https://infrastack.ai/live/CVE-2026-123829 (this .md is for agents)

On macOS and Windows, recursive fs.watch() in Node.js reports the names of files in subdirectories that the Permission Model should block. An attacker-controlled process gets file and directory names and timing, but not file contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `node --version` and compare against the affected lines 22.x, 24.x and 26.x
- Check whether the app runs with `--permission` and uses `fs.watch()` or `fs.promises.watch()` with `recursive: true` on macOS or Windows

## Timeline

- 2026-11-11T19:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123829

## From the sources

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_