@@ -2787,6 +2787,16 @@ function realpathSync(p, options) {
   validatePath(p);
   p = pathModule.resolve(p);
 
+  // Check the resolved input path up front so that the lstat walk below cannot
+  // be used to probe the existence of paths outside the granted set.
+  if (permission.isEnabled() && !permission.has('fs.read', p)) {
+    throw new ERR_ACCESS_DENIED(
+      'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+      'FileSystemRead',
+      p,
+    );
+  }
+
   const cache = options[realpathCacheKey];
   const maybeCachedResult = cache?.get(p);
   if (maybeCachedResult) {
 
@@ -32,8 +32,20 @@ function rmSync(pathname, useSpawn) {
   }
 }
 
+// Under the permission model, fs.realpathSync() requires read access to the
+// path, which tests running with a restricted --allow-fs-read may not grant
+// for NODE_TEST_DIR.
+function resolveTestRoot(dir) {
+  try {
+    return fs.realpathSync(dir);
+  } catch (err) {
+    if (err.code !== 'ERR_ACCESS_DENIED') throw err;
+    return path.resolve(dir);
+  }
+}
+
 const testRoot = process.env.NODE_TEST_DIR ?
-  fs.realpathSync(process.env.NODE_TEST_DIR) : path.resolve(__dirname, '..');
+  resolveTestRoot(process.env.NODE_TEST_DIR) : path.resolve(__dirname, '..');
 
 // Using a `.` prefixed name, which is the convention for "hidden" on POSIX,
 // gets tools to ignore it by default or by simple rules, especially eslint.
 
@@ -698,6 +698,57 @@ const regularFile = __filename;
   });
 }
 
+// fs.realpath (JS implementation, walks the path with lstat)
+{
+  assert.throws(() => {
+    fs.realpathSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.realpathSync(bufferBlockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.realpathSync(path.join(blockedFolder, 'anyfile'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  // Must not act as a file-existence oracle: a non-existent path inside a
+  // blocked folder must be denied, not reported as ENOENT.
+  assert.throws(() => {
+    fs.realpathSync(path.join(blockedFolder, 'does-not-exist'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  fs.realpath(blockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.realpathSync(blockedFile);
+  }, common.expectsError({
+    message: 'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: blockedFile,
+  }));
+  assert.rejects(async () => {
+    await fsPromises.realpath(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  })).then(common.mustCall());
+
+  // doesNotThrow
+  assert.strictEqual(typeof fs.realpathSync(regularFile), 'string');
+}
+
 // fs.realpath.native
 {
   fs.realpath.native(blockedFile, common.expectsError({
 
@@ -44,7 +44,7 @@ const { spawnSync } = require('node:child_process');
   );
 
   assert.strictEqual(status, 1, stderr.toString());
-  assert.match(stderr.toString(), /Error: Access to this API has been restricted/);
+  assert.match(stderr.toString(), /Error(?: \[ERR_ACCESS_DENIED\])?: Access to this API has been restricted/);
 }
 
 {
@@ -78,5 +78,5 @@ const { spawnSync } = require('node:child_process');
   );
 
   assert.strictEqual(status, 1, stderr.toString());
-  assert.match(stderr.toString(), /Error: Access to this API has been restricted/);
+  assert.match(stderr.toString(), /Error(?: \[ERR_ACCESS_DENIED\])?: Access to this API has been restricted/);
 }
Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ const { spawnSync } = require('node:child_process');`
`44`	`44`	`);`
`45`	`45`
`46`	`46`	`assert.strictEqual(status, 1, stderr.toString());`
`47`		`- assert.match(stderr.toString(), /Error: Access to this API has been restricted/);`
	`47`	`+ assert.match(stderr.toString(), /Error(?: \[ERR_ACCESS_DENIED\])?: Access to this API has been restricted/);`
`48`	`48`	`}`
`49`	`49`
`50`	`50`	`{`
`@@ -78,5 +78,5 @@ const { spawnSync } = require('node:child_process');`
`78`	`78`	`);`
`79`	`79`
`80`	`80`	`assert.strictEqual(status, 1, stderr.toString());`
`81`		`- assert.match(stderr.toString(), /Error: Access to this API has been restricted/);`
	`81`	`+ assert.match(stderr.toString(), /Error(?: \[ERR_ACCESS_DENIED\])?: Access to this API has been restricted/);`
`82`	`82`	`}`