Detections
Analytics

Chainguard: multiple nodejs-22 packages: security update to 22.22.3-r0

low Tenable Self-Hosted Container Security Plugin ID 477884

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises
 API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`,
 `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted
 `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and
 ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability
 affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is
 intentionally restricted. (CVE-2026-21716)

Solution

Update the nodejs-22 library and its related packages to version 22.22.3-r0 or later.

Plugin Details

Severity: Low

ID: 477884

Version: Revision 1.1

Type: Local

Published: 10/29/2026

Updated: 10/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-21716

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.9

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/30/2026

Reference Information

CVE: CVE-2026-21716