Node.js Internal Worker Leak Vulnerability Allowing Permission Bypass

A vulnerability exists in Node.js versions 20, 22, and 23 for users with the Permission Model enabled. By using the diagnostics_channel utility, it is possible to intercept events when a worker thread is created. This not only applies to regular worker threads but also reveals internal workers, allowing an instance to be accessed. The constructor of this internal worker can be extracted and reused for malicious purposes, effectively bypassing the permission model restrictions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal worker threads, allowing for manipulation or misuse of their constructors in a harmful way.