Skip to main content

Node.js CVE-2026-48617

| EUVDEUVD-2026-37914 HIGH
Improper Access Control (CWE-284)
2026-06-18 GHSA-rv82-5vqw-69hj
Authentication Bypass Node.js Red Hat Suse Node Js
High
Disputed · 8.2 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Launch Node.js with --permission flag enabled
  2. Delivery
    Achieve code execution within the restricted process
  3. Exploit
    Call process.chdir() to relocate working directory
  4. Execution
    Trigger diagnostic report generation
  5. Impact
    Report written to path outside permission model's intended write scope

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires three concrete conditions: first, the target Node.js process must have been launched with the experimental --permission flag enabling the permission model (this is a non-default, opt-in configuration); second, the attacker must already have code execution capability within that Node.js process (e.g., via a separate vulnerability or by running attacker-supplied scripts); third, the process must have access to the diagnostic report write path or the process.chdir() call must be reachable. What limits exploitation: the permission model is experimental and disabled by default, making it uncommon in production; code execution within the target process is a required prerequisite; and the impact is limited to writing files outside permitted paths rather than arbitrary command execution or credential disclosure. The SSVC assessment of 'automatable: no' further reflects these preconditions.
Impact

CRITICAL DATA DISCREPANCY: The provided CVSS score of 8.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N is irreconcilable with CVE-2026-48617 as described. A network-accessible, unauthenticated flaw with high confidentiality impact does not correspond to a local permission model bypass in the write-report path. The Node.js security team themselves rated this CVE as 'Low' severity in the same release notes from which the description is drawn. The 8.2 CVSS and its vector likely belong to a different CVE in the same release (e.g., CVE-2026-48618 or CVE-2026-48933, both rated High). Security teams should NOT use the 8.2 score for prioritization of this specific CVE. Real-world risk signals are uniformly low: EPSS is 0.20% (10th percentile), SSVC reports exploitation as none and automatable as no with only partial technical impact, and the permission model itself is an experimental, opt-in feature, further constraining the attack surface. This vulnerability only affects deployments explicitly using the --permission flag.
Exploit ScenarioDerived

An attacker who has achieved code execution within a Node.js process that was launched with the --permission flag (restricting writable paths) calls process.chdir() to shift the working directory to a sensitive location outside the permitted write scope, then triggers diagnostic report generation. The resulting report file is written to the unauthorized path, potentially overwriting sensitive files or planting attacker-controlled content where the application would not ordinarily be permitted to write. No public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Aug 19, 2026

Improper access control in Node.js's experimental permission model allows a process running under restricted permissions to bypass write-path enforcement via process.chdir() when generating diagnostic reports. Affected are Node.js versions through 22.22.3, 24.16.0, and 26.3.0 across all three active release lines. No public exploit has been identified at time of analysis, and EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) both indicate very low real-world exploitation likelihood - consistent with the Node.js security team's own 'Low' severity classification for this specific CVE within the June 2026 security release.

Earlier versions of this analysis (1)
v1 Jul 22, 2026 - 21:17 CVSS 1.8

Permission model bypass in Node.js allows a local high-privileged attacker to redirect file write operations outside the scope granted by the experimental permission model by exploiting improper handling of process.chdir() in the writereport code path. Affected versions span the v22.x (≤22.22.3), v24.x (≤24.16.0), and v26.x (≤26.3.0) release lines. No public exploit exists and no active exploitation is confirmed; all risk signals - CVSS 1.8, EPSS 0.20% at the 10th percentile, and SSVC exploitation status of none - converge on minimal real-world priority, further constrained by the non-default experimental flag required to expose the vulnerable code path.

RemediationAI

The primary fix is to upgrade Node.js to the patched versions released on 2026-06-18: v26.3.1 (Current), and the corresponding patched builds for the 22.x and 24.x LTS lines as documented at https://nodejs.org/en/blog/vulnerability/june-2026-security-releases and https://github.com/nodejs/node/releases/tag/v26.3.1. Exact fix versions for 22.x and 24.x LTS lines should be confirmed via the official Node.js blog advisory. As a compensating control for deployments that cannot immediately patch, avoid invoking process.chdir() within any application running under the --permission model, or disable diagnostic report generation (remove --report-* flags) to eliminate the affected code path. Note that disabling reports may impact observability for incident response. Since the permission model is opt-in and experimental, deployments not using --permission are not affected and require no action.

Affected VersionsENISA

Node 22.22.3 ≤22.22.3
Node 26.3.0 ≤26.3.0
Node 24.16.0 ≤24.16.0

Affected Packages

euvd node no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Node.js's experimental permission model (enabled via the --permission flag) enforces filesystem access controls at the process level, restricting which paths a given Node.js application can read or write. The diagnostic report feature allows Node.js to write process health reports to a configured directory. CWE-284 (Improper Access Control) applies here: when process.chdir() is called to change the working directory, the permission model's enforcement of the write-report destination path fails to account for the new working directory context, allowing a relative path to resolve outside the permitted scope. The affected CPE is cpe:2.3:a:nodejs:node.js across the 22.x, 24.x, and 26.x release lines (non-LTS variant, as indicated by the '-' suffix in CPE strings). The fix is attributed to RafaelGSS (commit context: nodejs-private/node-private) in the v26.3.1 release.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (CNA) PRIMARY LOW
NVD 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
vuln.today AI 3.3 LOW

Local vector because exploitation requires pre-existing code execution within the process; PR:L since the attacker controls code in the process; integrity-only impact limited to writing outside permitted paths.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 2.9 MEDIUM
AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Red Hat 2.9 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

4
Severity Changed
Aug 19, 2026 - 20:07 NVD
LOW HIGH
CVSS changed
Aug 19, 2026 - 20:07 NVD
1.8 (LOW) 8.2 (HIGH)
CVE Published
Jun 18, 2026 - 04:37 github-releases
LOW 1.8
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Node.js versions 22-26 contain a privilege escalation vulnerability in an experimental permission model (CVE-2026-48617) with no public exploit identified at time of analysis. Real-world exploitation likelihood is extremely low per EPSS metrics and vendor assessment, but organizations should apply the available patch to eliminate this attack vector, especially for systems using the experimental permission feature.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 90% exploitable
Prevalence
High
Node.js is a dominant server-side JavaScript runtime used across millions of production deployments
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Medium
Technical Impact
Partial

Priority Score

20
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +20
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Leap 16.0 Fixed

References

Advisories & patches
ADVISORY http://hackerone.com/reports/3692858 ADVISORY https://access.redhat.com/errata/RHSA-2026:45381 ADVISORY https://access.redhat.com/errata/RHSA-2026:45783 ADVISORY https://access.redhat.com/errata/RHSA-2026:46197 ADVISORY https://github.com/nodejs/node/releases/tag/v26.3.1 ADVISORY https://nodejs.org/en/blog/vulnerability/june-2026-security-releases ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-48617 ADVISORY https://seclists.org/oss-sec/2026/q2/984 ADVISORY https://vuldb.com/vuln/372240 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-48617 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22368/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22565/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2633/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2647/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2695/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy