Node.js Permission Model Flaw Allowed Bypass in Multiple Versions

CVE-2026-48617

What is CVE-2026-48617?

A vulnerability has been identified in Node.js that affects the enforcement of its permission model. Specifically, the flaw allows for a bypass via the process.report.writeReport() method due to path misvalidation. This issue can lead to potential confidentiality breaches or unauthorized access across all supported release lines including Node.js 22, 24, and 26. Best practices and timely updates are essential to safeguard applications relying on Node.js.

References