setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
{ "severity": "High", "cpes": [ "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*" ] }