EUVD-2026-51022
GHSA-hw7r-7v27-7388
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Local-only exploitation requiring an existing low-privilege process context with experimental permission mode enabled; impact is limited to unauthorized integrity writes with no confidentiality or availability effect.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
7Description PRE-NVD
AnalysisAI
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
Technical ContextAI
Node.js's experimental Permission Model, activated via the --experimental-permission CLI flag, allows operators to explicitly constrain what filesystem paths a process may read or write using --allow-fs-read and --allow-fs-write. The trace events subsystem, enabled via --trace-event-categories or --trace-events-enabled, writes structured diagnostic output to disk as part of V8 and Node.js core instrumentation. CVE-2026-56847 exposes a gap where the Permission Model's fs write enforcement is not applied to the path used by trace events output, meaning trace data can be written to locations outside the operator-defined allow-list. The assigned CWE is CWE-1119 (Insufficient Documentation of Error Handling Techniques), though the root cause is more precisely an access-control enforcement gap consistent with CWE-863 (Incorrect Authorization) - this discrepancy is worth noting. Affected CPE entries span the 22.x (Maintenance LTS), 24.x (Active LTS), and 26.x (Current) Node.js release lines per EUVD-2026-51022.
RemediationAI
Upgrade to Node.js 26.5.1 or the corresponding patched release for the active 22.x or 24.x branch, as announced in the July 2026 Node.js security releases at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases and detailed at https://github.com/nodejs/node/releases/tag/v26.5.1. If an immediate upgrade is not feasible and the deployment uses --experimental-permission, the most targeted workaround is to remove trace event flags (--trace-event-categories, --trace-events-enabled) from the Node.js invocation, eliminating the write path that bypasses Permission Model enforcement; note that this sacrifices diagnostic trace capability. Deployments not using --experimental-permission require no action, as the vulnerability is entirely scoped to that non-default mode.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today