The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path.
This misleading documentation affects all users using the experimental permission model in active release lines: 20.x and 21.x.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.