node.js security

Microsoft’s CVE-2026-21715 advisory points to a Node.js Permission Model bypass that matters most for applications relying on --permission and restricted --allow-fs-read settings. In practical terms, the flaw lets fs.realpathSync.native() sidestep the read-permission checks that comparable...