GHSA-p498-v437-472g: humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

September 2, 2026

@humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll() read and copy the contents of any file readable by the process, even when that file is outside the directory being copied.

References

github.com/advisories/GHSA-p498-v437-472g
github.com/humanwhocodes/humanfs/commit/22bbaa4487a3e6c1197ca619840de4615d0c3404
github.com/humanwhocodes/humanfs/releases/tag/node-v0.16.8
github.com/humanwhocodes/humanfs/security/advisories/GHSA-p498-v437-472g

Code Behaviors & Features

Detect and mitigate GHSA-p498-v437-472g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →