Error: Access to this API has been restricted (EPERM) when running Node with --permission
You started Node with the security permission model (`--permission`) but didn't grant access to the specific resource your code touches. Filesystem paths, child processes, and worker threads each need explicit flags like `--allow-fs-read`, `--allow-fs-write`, or `--allow-child-process`.
What causes this error
Running Node with --permission flips the runtime into a deny-by-default sandbox: filesystem reads/writes, spawning child processes, and creating worker threads are all blocked unless you explicitly allow them. This is intentional defense-in-depth — the error is Node correctly refusing an operation you never granted.
The Fix
# Wrong — permission model on, nothing granted, any fs access throws EPERM
node --permission app.js
# Fix — grant exactly the access your app needs
node --permission \
--allow-fs-read=/app/data \
--allow-fs-write=/app/logs \
--allow-child-process \
app.jsPrefer the narrowest grants that let your app actually run — pointing --allow-fs-read/--allow-fs-write at specific directories rather than the whole filesystem preserves most of the security benefit.
Common causes / variations
- Enabling `--permission` in production without auditing every filesystem path and subprocess the app touches
- A dependency spawning a child process (e.g. for native compilation or a CLI wrapper) that isn't covered by your grants
- Worker threads needing their own explicit permission flags, separate from the main thread's
Related errors
See also: ERR_INVALID_ARG_TYPE (fs/promises), EADDRINUSE.
Comments
Loading comments...