Repository navigation
Permission Inheritance (--allow-worker inherits parent permissions) #62222
Description
What is the problem this feature will solve?
Today, --allow-worker is an all-or-nothing escape hatch. The docs state this explicitly as a constraint: "The model does not inherit to a worker thread." This means any code running inside a worker can access the filesystem, spawn child processes, and do anything else without restriction, regardless of what the main thread was allowed to do.
This defeats the purpose of the permission model for any application that uses workers, which is most CPU-intensive Node.js applications.
What is the feature you are proposing to solve the problem?
When the main thread creates a Worker, the worker inherits a snapshot of the parent thread's permission state at the time of creation. The worker starts with exactly the same permissions as its parent — no more, no less.
// Main thread: started with --permission --allow-fs-read=/app --allow-worker
const { Worker } = require('node:worker_threads');
const worker = new Worker('./task.js');
// task.js runs with fs.read granted for /app only
// task.js cannot spawn child processes (parent couldn't either)
// task.js cannot read /etc, /home, or anything outside /appThis might be a breaking change. We could then add a --allow-inherit-worker to achieve the same.
What alternatives have you considered?
No response
Activity
mcollina commentedon Mar 12, 2026
cc @nodejs/security-wg
RafaelGSS commentedon Mar 12, 2026
FWIW We already do it for child_process #58853. But, this can be overridden by the user If I'm not wrong.
Happy686876 commentedon Mar 20, 2026
Happy
Happy686876 commentedon Mar 20, 2026
Happy
mawalu commentedon Jun 19, 2026
Edit: For anyone else finding this issue, the default behaviour is to inherit parent permissions, but this can be bypassed by setting
{ execArgv: [] }on Worker creationgithub-actions commentedon Sep 21, 2026
This issue has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.