EUVD-2026-39608
GHSA-9qm6-cjgc-f64v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Local-only exploitation (AV:L) requiring low-privilege credentials (PR:L); impact strictly limited to file timestamp modification (I:L) with no content, confidentiality, or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on paths outside their permitted write scope. Affecting Node.js 26.x before v26.3.1, this flaw is only exploitable when the experimental permission model is explicitly enabled via --experimental-permission, substantially limiting exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Node.js 26.x prior to v26.3.1 must be installed; (2) the experimental permission model must be explicitly enabled at process startup via the --experimental-permission CLI flag - this is NOT the default Node.js configuration; (3) the attacker must have local system access with at least low-privilege credentials (PR:L per the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.3 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege credentials on a system running Node.js 26.x with --experimental-permission enabled writes a short script invoking FileHandle.utimes() targeting a sensitive file path outside their permitted write scope. The permission model fails to reject the call, allowing the attacker to alter the file's access and modification timestamps - potentially covering tracks or defeating timestamp-based integrity monitoring. … |
| Remediation | Upgrade Node.js to version 26.3.1 or later; this is the vendor-confirmed patched release per https://github.com/nodejs/node/releases/tag/v26.3.1 and https://nodejs.org/en/blog/vulnerability/june-2026-security-releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrict
Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connec
Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto c
Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connect
Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials whe
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unha
Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostnam
TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privile
TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an info
Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticat
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today