Skip to main content

Node.js EUVDEUVD-2026-37914

| CVE-2026-48617 HIGH
Improper Access Control (CWE-284)
2026-06-18 GHSA-rv82-5vqw-69hj
Authentication Bypass Node Js Red Hat Suse
High
Disputed · 8.2 NVD
Share

Severity by source

Sources disagree (Low–High)
Vendor (CNA) PRIMARY
LOW
qualitative
NVD
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
vuln.today AI
3.3 LOW

Local vector because exploitation requires pre-existing code execution within the process; PR:L since the attacker controls code in the process; integrity-only impact limited to writing outside permitted paths.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
2.9 MEDIUM
AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Red Hat
2.9 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

8
Analysis Updated
Aug 19, 2026 - 20:14 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 19, 2026 - 20:07 vuln.today
cvss_changed
Severity Changed
Aug 19, 2026 - 20:07 NVD
LOW HIGH
CVSS changed
Aug 19, 2026 - 20:07 NVD
1.8 (LOW) 8.2 (HIGH)
Source Code Evidence Fetched
Jul 22, 2026 - 21:17 vuln.today
Analysis Generated
Jul 22, 2026 - 21:17 vuln.today
CVE Published
Jun 18, 2026 - 04:37 github-releases
LOW 1.8
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Improper access control in Node.js's experimental permission model allows a process running under restricted permissions to bypass write-path enforcement via process.chdir() when generating diagnostic reports. Affected are Node.js versions through 22.22.3, 24.16.0, and 26.3.0 across all three active release lines. No public exploit has been identified at time of analysis, and EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) both indicate very low real-world exploitation likelihood - consistent with the Node.js security team's own 'Low' severity classification for this specific CVE within the June 2026 security release.

Technical ContextAI

Node.js's experimental permission model (enabled via the --permission flag) enforces filesystem access controls at the process level, restricting which paths a given Node.js application can read or write. The diagnostic report feature allows Node.js to write process health reports to a configured directory. CWE-284 (Improper Access Control) applies here: when process.chdir() is called to change the working directory, the permission model's enforcement of the write-report destination path fails to account for the new working directory context, allowing a relative path to resolve outside the permitted scope. The affected CPE is cpe:2.3:a:nodejs:node.js across the 22.x, 24.x, and 26.x release lines (non-LTS variant, as indicated by the '-' suffix in CPE strings). The fix is attributed to RafaelGSS (commit context: nodejs-private/node-private) in the v26.3.1 release.

RemediationAI

The primary fix is to upgrade Node.js to the patched versions released on 2026-06-18: v26.3.1 (Current), and the corresponding patched builds for the 22.x and 24.x LTS lines as documented at https://nodejs.org/en/blog/vulnerability/june-2026-security-releases and https://github.com/nodejs/node/releases/tag/v26.3.1. Exact fix versions for 22.x and 24.x LTS lines should be confirmed via the official Node.js blog advisory. As a compensating control for deployments that cannot immediately patch, avoid invoking process.chdir() within any application running under the --permission model, or disable diagnostic report generation (remove --report-* flags) to eliminate the affected code path. Note that disabling reports may impact observability for incident response. Since the permission model is opt-in and experimental, deployments not using --permission are not affected and require no action.

More in Node Js

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
CVE-2015-3194 HIGH
7.5 Dec 06

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial

CVE-2016-2105 HIGH
7.5 May 05

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
CVE-2022-3786 HIGH POC
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2024-3566 CRITICAL POC
9.8 Apr 10

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Leap 16.0 Fixed

Share

EUVD-2026-37914 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy