RafaelGSS · Oct 15, 2026
diff --git a/doc/api/permissions.md b/doc/api/permissions.md
@@ -350,6 +350,10 @@ const databaseUrl = process.env.DATABASE_URL;
 process.permission.drop('env', 'DATABASE_URL');
 ```
 
+Wildcards cannot be dropped: `process.permission.drop('env', 'APP_*')` and
+`process.permission.drop('env', '*')` throw `ERR_INVALID_ARG_VALUE`. To remove
+every variable, drop the whole `env` scope.
+
 When a process that enforces the Permission Model spawns a child process, the
 child is started with `--allow-env=*`: the environment it inherits only contains
 variables that the parent had access to. The child can still read its own

diff --git a/doc/api/process.md b/doc/api/process.md
@@ -3250,7 +3250,7 @@ The available scopes are the same as [`process.permission.has()`][]:
 * `fs.write` - File System write operations
 * `child` - Child process spawning operations
 * `env` - Environment variables. Dropping a variable removes it from the
-  environment
+  environment. A reference ending with `*` is not accepted
 * `openssl.store` - Loading keys through OpenSSL STORE loaders
 * `worker` - Worker thread spawning operation
 * `net` - Network operations

diff --git a/src/permission/permission.cc b/src/permission/permission.cc
@@ -122,6 +122,14 @@ static void Drop(const FunctionCallbackInfo<Value>& args) {
     // are not guaranteed to be valid UTF-8.
     BufferValue resource(env->isolate(), args[1]);
     if (resource.length() > 0) {
+      // A wildcard would drop more than one variable at once. Dropping the
+      // whole scope, without a reference, is the only way to do that.
+      if (scope == PermissionScope::kEnv &&
+          resource.ToStringView().back() == '*') {
+        return THROW_ERR_INVALID_ARG_VALUE(
+            env,
+            "Wildcards are not supported when dropping environment variables");
+      }
       env->permission()->Drop(env, scope, resource.ToStringView());
       return;
     }

diff --git a/test/parallel/test-permission-env-drop.js b/test/parallel/test-permission-env-drop.js
@@ -68,3 +68,23 @@ spawnSyncAndAssert(
   ],
   { env },
   {});
+
+// Wildcards cannot be dropped, and nothing is removed.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-env=PERMISSION_ENV_*', '-e',
+    `
+    const assert = require('assert');
+    for (const reference of ['PERMISSION_ENV_*', '*']) {
+      assert.throws(() => process.permission.drop('env', reference), {
+        code: 'ERR_INVALID_ARG_VALUE',
+      });
+    }
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_ONE'), true);
+    assert.strictEqual(process.env.PERMISSION_ENV_ONE, 'one');
+    assert.strictEqual(process.env.PERMISSION_ENV_TWO, 'two');
+    `,
+  ],
+  { env },
+  {});