fs.glob returns no matches when `--allow-fs-read` is used

[louiellan]

Version

22.22.1 (22.x), 24.14.0 (24.x), 25.8.1 (25.x)

Platform

Linux louiellan-IdeaPad-3-15ITL6 6.14.0-37-generic #37~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 20 10:25:38 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

fs, permission

What steps will reproduce the bug?

Create the file

sample1.js

const fs = require('fs')
console.log(fs.globSync('somedir/*'));

Directory Structure

somedir
|--> file1.js
sample1.js

Run the following commands:

node --permission --allow-fs-read=somedir/ ./sample1.js

How often does it reproduce? Is there a required condition?

The bug consistently reproduces if the --allow-fs-read is given a specific directory such as somedir/, but not with the allow all *

What is the expected behavior? Why is that the expected behavior?

1. fs.globSync should return matches as it has a read access to that given directory
2. asynchronous fs.glob (also from node:fs/promises) returns matches to that given directory

---

Code snippet for checking fs.glob working as intended
sample2.js
(works just fine - for comparison)

const fsPromise = require('fs/promises'); 
(async () => {
for await (const entry of fsPromise.glob('somedir/*')) {
    console.log(entry);
}})();

sample3.js
(works just fine - for comparison)

const fs = require('node:fs');
fs.glob('somedir/*', (err, matches) => {
    if (err) throw err;
    console.log(matches);
});

Running the files

node --permission --allow-fs-read=somedir/ ./sample2.js
node --permission --allow-fs-read=somedir/ ./sample3.js

What do you see instead?

Empty matches

[]

Additional information

came across this when @RafaelGSS suggested to include permission model tests while using glob on --watch-path
Refs: #59478

[RafaelGSS]

Does somedir exists previously? if not, try with --allow-fs-read="somedir/*". I'm not on my computer to test it right now.

[louiellan]

yep, somedir exists prior to running the sample files. I also did having a somedir/*, it still throws an error

[artsiom-malakhau]

I'm working on this issue, and it seems I've found the root of the problem. The thing is, during sync processing, we get a folder access error that we don't handle in any special way. Meanwhile, in cases like glob(), we handle this situation and simply continue traversing the directories. I'm currently working on a fix

[louiellan]

FWIW, after #60674 was merged, the ERR_ACCESS_DENIED does not show up anymore, but still doesn't show any matches within the directory

[khalidsaidi]

A2ABench has an accepted answer for this imported thread.

• Thread: https://a2abench-api.web.app/q/cmmo7iil8000z14fl40n4j9ir
• Accepted at: 2026-03-25T19:41:07.434Z
• Accepted answer agent: ai village
• Answer preview: "No matching threads were found for this query."