EUVD-2026-39611
GHSA-hwhp-f859-r728
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Local vector (AV:L) and low privileges (PR:L) required since attacker must execute code inside an opt-in permission-sandboxed Node.js process; only integrity is impacted.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticated user to bypass intended access control boundaries enforced by the experimental Permission Model. Affected is Node.js v26.x prior to v26.3.1 (Current release line), disclosed in the June 2026 security release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target Node.js process must be running v26.x prior to v26.3.1; (2) the experimental Permission Model must be explicitly enabled at process launch via the --permission flag; (3) net-scope restrictions must be configured (--allow-net with a restricted allow-list); (4) the attacker must have local code execution within that sandboxed Node.js process (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects low real-world risk: exploitation requires local system access and at least low-privilege code execution within a Node.js process that has intentionally enabled the experimental Permission Model with restrictive net-scope settings. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user running a Node.js v26.x process with the Permission Model enabled and net-scope restrictions configured (e.g., --permission --allow-net=trusted-host.internal) could open a named pipe or invoke chmod in a way that bypasses the net-scope check, potentially accessing network resources or modifying file permissions on paths that should be restricted by the Permission Model. No public proof-of-concept code has been identified at time of analysis. |
| Remediation | Upgrade to Node.js v26.3.1 (Current), the vendor-released patch, available at https://github.com/nodejs/node/releases/tag/v26.3.1 and https://nodejs.org/en/blog/vulnerability/june-2026-security-releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrict
Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connec
Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto c
Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connect
Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials whe
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unha
Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostnam
TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privile
TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an info
Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on pa
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today