From 04e88bdfa9ea094f752e513f999101af2c6234ac Mon Sep 17 00:00:00 2001
From: Artsiom Malakhau <artem.malakhov.dev@gmail.com>
Date: Tue, 27 Jan 2026 14:00:18 -0500
Subject: [PATCH] fs: fix globSync traverse on allowed directory

Fix an issue where fs.globSync failed to find files when read access
was granted only for a certain directory via the --allow-fs-read flag.

Fixes: https://github.com/nodejs/node/issues/61499
---
 lib/internal/fs/glob.js                  |  2 +-
 test/parallel/test-fs-glob-permission.js | 71 ++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-fs-glob-permission.js

diff --git a/lib/internal/fs/glob.js b/lib/internal/fs/glob.js
index 526efd4c010d7c..9e1748b0ff7526 100644
--- a/lib/internal/fs/glob.js
+++ b/lib/internal/fs/glob.js
@@ -408,7 +408,7 @@ class Glob {
       this.#results.add(path);
     }
 
-    if (!isDirectory) {
+    if (!isDirectory && stat !== null) {
       return;
     }
 
diff --git a/test/parallel/test-fs-glob-permission.js b/test/parallel/test-fs-glob-permission.js
new file mode 100644
index 00000000000000..a9242124040426
--- /dev/null
+++ b/test/parallel/test-fs-glob-permission.js
@@ -0,0 +1,71 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { spawnSyncAndAssert } = require('../common/child_process');
+const tmpdir = require('../common/tmpdir');
+
+// This test verifies that fs.globSync() works correctly udner permission model
+// when --allow-fs-read is granted only to the certain directory
+
+// Example:
+// Directory structure:
+//   somedir/
+//     file1.js
+//   sample.js
+//
+// Command:
+//   node --permission --allow-fs-read=somedir/ sample.js
+//
+// Code:
+//   fs.globSync('somedir/*') <- sould find file1.js
+
+tmpdir.refresh();
+
+const someDir = tmpdir.resolve('somedir');
+const script = tmpdir.resolve('sample.js');
+
+fs.mkdirSync(someDir);
+fs.writeFileSync(
+  path.join(someDir, 'file1.js'),
+  'console.log("test");'
+);
+
+fs.writeFileSync(
+  script,
+  `
+'use strict';
+const fs = require('fs');
+const matches = fs.globSync('somedir/*');
+console.log(JSON.stringify(matches));
+`
+);
+
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission',
+    `--allow-fs-read=${someDir}`,
+    script,
+  ],
+  {
+    cwd: tmpdir.path,
+  },
+  {
+    stdout(output) {
+      assert.deepStrictEqual(
+        JSON.parse(output),
+        ['somedir/file1.js']
+      );
+      return true;
+    },
+    stderr(output) {
+      assert.doesNotMatch(output, /ERR_ACCESS_DENIED/);
+      return true;
+    },
+  }
+);