Skip to main content

Node.js CVE-2026-56847

| EUVDEUVD-2026-51022 MEDIUM
Excessive Use of Unconditional Branching (CWE-1119)
2026-07-29 GHSA-hw7r-7v27-7388
Information Disclosure Node.js Red Hat Suse Node Js
6.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access to host
  2. Exploit
    Invoke Node.js with --experimental-permission and trace events active
  3. Execution
    Trace output routine bypasses fs write permission check
  4. Impact
    Write diagnostic data to operator-restricted filesystem paths

Vulnerability Assessment

Weakness
CWE
CWE-1119
Exploitation Conditions

Exploitation requires all of the following to be simultaneously true: (1) Node.js must be invoked with the --experimental-permission flag, as the Permission Model is an opt-in experimental feature and is entirely absent in standard Node.js deployments; (2) the trace events subsystem must be active via --trace-event-categories or --trace-events-enabled flags; (3) the attacker must have local access with sufficient privilege to run or influence the Node.js process invocation (CVSS PR:L). Standard Node.js deployments that do not use --experimental-permission are wholly unaffected regardless of version. The combination of experimental opt-in plus local-only access (AV:L) substantially limits real-world exposure beyond what the integrity-bypass framing might suggest.
Impact

The CVSS 3.0 base score of 3.3 (Low) accurately reflects the constrained attack surface: AV:L requires local code execution, PR:L requires an existing low-privileged process context, and the impact is limited to a low-severity integrity bypass (I:L) with no confidentiality or availability impact. Real-world risk is further bounded by the requirement that the victim deployment opts into the experimental Permission Model - a non-default, explicitly configured feature - meaning the vast majority of Node.js deployments are entirely unexposed. No EPSS score was provided in the intelligence feed; given the niche exploitation conditions, probability of opportunistic exploitation is assessed as very low. No KEV listing and no public exploit code identified at time of analysis. The 'Information Disclosure' tag in the EUVD source data conflicts with the CVSS impact metrics (C:N, I:L, A:N), which indicate only an integrity bypass and no data leakage - this inconsistency should be verified with the Node.js security team, as the tag may be a metadata error or may reflect secondary information exposure not captured in the primary description.
Exploit ScenarioDerived

A local attacker who can run or inject arguments into a Node.js process on a host where the experimental Permission Model is active invokes Node.js with trace events enabled alongside --allow-fs-write restricted to safe paths; the trace events output routine bypasses the permission check and writes diagnostic files to a restricted filesystem location. No public exploit code exists, but the primitive is straightforward once the specific configuration is understood, requiring no memory corruption or complex technique.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.

RemediationAI

Upgrade to Node.js 26.5.1 or the corresponding patched release for the active 22.x or 24.x branch, as announced in the July 2026 Node.js security releases at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases and detailed at https://github.com/nodejs/node/releases/tag/v26.5.1. If an immediate upgrade is not feasible and the deployment uses --experimental-permission, the most targeted workaround is to remove trace event flags (--trace-event-categories, --trace-events-enabled) from the Node.js invocation, eliminating the write path that bypasses Permission Model enforcement; note that this sacrifices diagnostic trace capability. Deployments not using --experimental-permission require no action, as the vulnerability is entirely scoped to that non-default mode.

Affected VersionsENISA

Node 26.5.0 ≤26.5.0
Node 22.23.1 ≤22.23.1
Node 24.18.0 ≤24.18.0

Affected Packages

euvd node no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Node.js's experimental Permission Model, activated via the --experimental-permission CLI flag, allows operators to explicitly constrain what filesystem paths a process may read or write using --allow-fs-read and --allow-fs-write. The trace events subsystem, enabled via --trace-event-categories or --trace-events-enabled, writes structured diagnostic output to disk as part of V8 and Node.js core instrumentation. CVE-2026-56847 exposes a gap where the Permission Model's fs write enforcement is not applied to the path used by trace events output, meaning trace data can be written to locations outside the operator-defined allow-list. The assigned CWE is CWE-1119 (Insufficient Documentation of Error Handling Techniques), though the root cause is more precisely an access-control enforcement gap consistent with CWE-863 (Incorrect Authorization) - this discrepancy is worth noting. Affected CPE entries span the 22.x (Maintenance LTS), 24.x (Active LTS), and 26.x (Current) Node.js release lines per EUVD-2026-51022.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
vuln.today AI 3.3 LOW

Local-only exploitation requiring an existing low-privilege process context with experimental permission mode enabled; impact is limited to unauthorized integrity writes with no confidentiality or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 3.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Red Hat 3.3 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

5
Severity Changed
Aug 25, 2026 - 17:52 NVD
LOW MEDIUM
CVSS changed
Aug 25, 2026 - 17:52 NVD
3.3 (LOW) 6.1 (MEDIUM)
CVSS changed
Jul 30, 2026 - 06:37 NVD
3.3 (LOW)
CVE Published
Jul 29, 2026 - 14:02 github-releases
UNKNOWN (no severity yet)
CVE Published
Jul 29, 2026 - 14:02 github-releases
LOW 3.3

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
High
widely deployed JavaScript runtime across enterprise backend, cloud, and CI environments
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Leap 16.0 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:48273 ADVISORY https://access.redhat.com/errata/RHSA-2026:48305 ADVISORY https://access.redhat.com/errata/RHSA-2026:48537 ADVISORY https://github.com/nodejs/node/releases/tag/v26.5.1 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56847 ADVISORY https://vuldb.com/vuln/384620 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-56847 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23131/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23154/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23155/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3557/ REF https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy