RafaelGSS 50ab804edc permission: check permission model in realpathSync ...

The equivalent entry points (fs.realpathSync.native(),
fs.promises.realpath(), fs.lstatSync(), fs.existsSync())
already deny access for the same paths

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/1011
Reviewed-By: Rich Trott <rtrott@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/973
CVE-ID: CVE-2026-106073

2026-10-20 19:26:14 +02:00

..

assert

assert: add assert/strict alias module

2020-06-25 08:37:48 -07:00

dns

dns: make promise API fully constructed from lib/internal/dns/promises

2022-06-20 19:58:45 +01:00

fs

fs: add fs/promises alias module

2020-02-18 22:15:50 -08:00

inspector

lib: revert to using default derived class constructors

2025-09-20 06:16:14 +00:00

internal

crypto: reset random caches across snapshots

2026-10-20 19:25:32 +02:00

path

path: add path/posix and path/win32 alias modules

2020-10-20 14:27:31 +00:00

readline

lib: revert to using default derived class constructors

2025-09-20 06:16:14 +00:00

stream

stream: add pipeline() for webstreams

2023-02-02 19:45:42 +00:00

test

test_runner: do not expose internal loader

2024-08-14 08:37:04 +02:00

timers

lib: remove unnecessary optional chaining

2024-11-27 11:03:33 -05:00

util

util: add util/types alias module

2020-10-21 01:26:34 +02:00

_http_agent.js

http: ensure agent data guard works without I/O

2026-10-19 23:29:48 +02:00

_http_client.js

http: fix keep-alive socket reuse race in requestOnFinish

2026-05-11 16:10:15 +02:00

_http_common.js

http: fix rawHeaders exceeding maxHeadersCount limit

2026-02-24 08:39:00 +01:00

_http_incoming.js

http: use null prototype for headersDistinct/trailersDistinct

2026-03-22 16:28:36 +01:00

_http_outgoing.js

http: lazy allocate cookies array

2026-02-19 18:46:22 +01:00

_http_server.js

http: improve writeEarlyHints by avoiding for-of loop

2025-10-22 23:44:05 +02:00

_stream_duplex.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_passthrough.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_readable.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_transform.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_wrap.js

lib: assign missed deprecation code

2019-03-07 15:48:55 +01:00

_stream_writable.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_tls_common.js

lib: backport _tls_common and _tls_wrap refactors

2026-03-16 17:29:52 +01:00

_tls_wrap.js

lib: backport _tls_common and _tls_wrap refactors

2026-03-16 17:29:52 +01:00

assert.js

lib: restructure assert to become a class

2025-08-26 11:22:39 +02:00

async_hooks.js

lib: do not modify prototype deprecated asyncResource (encore)

2025-09-20 06:10:44 +00:00

buffer.js

lib: use FastBuffer for empty buffer allocation

2026-02-24 00:36:56 +01:00

child_process.js

child_process: remove unsafe array iteration

2025-09-20 03:33:57 +00:00

cluster.js

cluster: use ObjectPrototypeHasOwnProperty

2023-05-25 16:04:19 +00:00

console.js

console: split console into global.js and constructor.js

2018-12-02 04:51:18 +08:00

constants.js

lib: flatten access to primordials

2019-11-25 10:28:15 +01:00

crypto.js

tools: add lint rule to keep primordials in ASCII order

2024-04-29 22:46:28 +02:00

dgram.js

lib: use FastBuffer for empty buffer allocation

2026-02-24 00:36:56 +01:00

diagnostics_channel.js

diagnostics_channel: fix race condition with diagnostics_channel and GC

2025-10-07 17:29:40 +02:00

dns.js

dns,net: reject hostnames with embedded NUL bytes

2026-06-17 19:52:19 +02:00

domain.js

domain: remove deprecated API call

2025-08-26 11:22:39 +02:00

eslint.config_partial.mjs

lib: enforce use of URLParse

2026-02-24 00:37:06 +01:00

events.js

test: ensure removeListener event fires for once() listeners

2026-02-24 08:39:02 +01:00

fs.js

permission: check permission model in realpathSync

2026-10-20 19:26:14 +02:00

http2.js

http2: add server handshake utility

2024-01-12 16:09:48 +00:00

http.js

http: expose websockets

2024-07-16 12:01:14 +02:00

https.js

https: bind identity checks to session reuse

2026-07-26 12:04:15 -03:00

inspector.js

inspector: initial support for Network.loadNetworkResource

2025-08-04 12:25:23 +02:00

module.js

lib: allow skipping source maps in node_modules

2025-02-06 01:10:44 +01:00

net.js

dns,net: reject hostnames with embedded NUL bytes

2026-06-17 19:52:19 +02:00

os.js

os: freeze signals constant

2026-02-24 00:37:08 +01:00

path.js

path: refactor path joining logic for clarity and performance

2025-09-20 06:17:29 +00:00

perf_hooks.js

lib: add trailing commas to all public core modules

2023-02-28 12:10:24 +01:00

process.js

src: disambiguate terms used to refer to builtins and addons

2022-08-09 01:36:49 +08:00

punycode.js

lib,src: isInsideNodeModules should test on the first non-internal frame

2026-02-17 15:14:07 +01:00

querystring.js

lib: prefer logical assignment

2024-11-27 11:03:39 -05:00

readline.js

lib: prefer logical assignment

2024-11-27 11:03:39 -05:00

repl.js

repl: add isValidParentheses check before wrap input

2025-10-07 16:07:13 +02:00

sea.js

sea: implement sea.getAssetKeys()

2025-09-20 06:16:51 +00:00

sqlite.js

sqlite: add DatabaseSync.prototype[Symbol.dispose]()

2025-04-17 10:51:46 -03:00

stream.js

stream: change stream to use index instead of for...of

2024-08-30 15:52:11 -03:00

string_decoder.js

lib: move encodingsMap to internal/util

2024-02-27 13:27:18 +01:00

sys.js

lib: add note about removing node:sys module

2024-09-12 11:06:42 +02:00

test.js

test_runner: add assert.register() API

2025-02-03 20:09:53 +01:00

timers.js

lib: remove redundant destroyHook checks

2026-02-17 19:12:19 +01:00

tls.js

tls: reject non-canonical IP addresses

2026-10-20 00:17:43 +02:00

trace_events.js

trace_events: use private fields instead of symbols for Tracing

2023-12-28 23:20:22 +00:00

tty.js

tty: initialize winSize array with values

2024-08-14 08:36:58 +02:00

url.js

url: replaced slice with at

2025-10-07 17:29:36 +02:00

util.js

util: preserve function names without source map names

2026-08-21 12:53:10 -05:00

v8.js

v8: add v8.getCppHeapStatistics() method

2025-04-17 10:51:20 -03:00

vm.js

lib: add validation for options in compileFunction

2025-01-05 12:57:36 -05:00

wasi.js

wasi: make returnOnExit true by default

2023-04-11 16:35:52 -04:00

worker_threads.js

worker: add name for worker

2025-09-20 03:32:52 +00:00

zlib.js

lib: use FastBuffer for empty buffer allocation

2026-02-24 00:36:56 +01:00