Riskcovery

CVE-2026-48617

State
Published
Severity
1.8 Low
Published
Jun 18, 2026
Updated
Jun 18, 2026
Reserved
May 22, 2026

Read the record on cve.org

Description

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Scores

CVSSScoreVectorSource
3.01.8 LowCVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:Nhackerone

Weaknesses

  • CWE-284 Improper Access Control - Generic

Affected Products

ProductVersions
nodenodejs
  • 22.22.3 through 22.22.3Affected
  • 24.16.0 through 24.16.0Affected
  • 26.3.0 through 26.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.