Node.js Worker Permission Bypass Vulnerability via InternalWorker Leak

A vulnerability exists in Node.js versions 20, 22, and 23 prior to the latest security releases, allowing Permission Model users to hook into events when worker threads are created. This issue not only pertains to regular workers but also exposes internal workers, enabling the fetching of an instance, extraction of its constructor, and potential misuse. Successful exploitation could lead to unauthorized access to internal worker functionalities, allowing for malicious manipulation or actions.

Impact

Exploitation of this vulnerability could result in unauthorized access to internal worker threads, allowing for sensitive information disclosure or unauthorized modification of data.

Remediation

Users can upgrade to Node.js versions 20.18.2, 22.13.1, or 23.6.1 to address this vulnerability.