Alle Dateien
patches/HXA-2026-001-block-native-addons.diff
# HXA-2026-001 — interim mitigation: deny native addon loading for third-party resources## This is the defensive patch, not an exploit. It closes the ungated `.node` load path# in the embedded server JS runtime until the Node 24 addon permission scope is# backported. Apply to the server JS runtime bootstrap. --- a/citizen/scripting/node/runtime-bootstrap.js+++ b/citizen/scripting/node/runtime-bootstrap.js@@ const Module = require('module');++// Deny loading of native addons (.node) from non-system resources. Node 22 has no+// addon permission scope (introduced in Node 24 as --allow-addons), so the FiveM+// permission handler is never consulted on process.dlopen. We gate it here instead.+const SYSTEM_ADDON_ROOTS = getSystemAddonRoots(); // FXServer-shipped modules only+const nativeExtension = Module._extensions['.node'];++Module._extensions['.node'] = function (module, filename) {+ if (!isUnderAnyRoot(filename, SYSTEM_ADDON_ROOTS)) {+ throw Object.assign(+ new Error(`native addon loading is denied for resource modules: ${filename}`),+ { code: 'ERR_ACCESS_DENIED' },+ );+ }+ return nativeExtension(module, filename);+};