CVE-2026-48617

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. Node.js includes an opt-in Permission Model that lets an application restrict its own access to the file system, child processes, and other capabilities at startup.

A flaw in Node.js's Permission Model enforcement (CVE-2026-48617) allows this restriction to be bypassed via process.report.writeReport(), due to insufficient validation of the path a diagnostic report is written to. Under an affected configuration, a script running under a restrictive Permission Model policy (for example, one granted no filesystem-write permission, or write permission limited to a specific directory) could use process.report.writeReport() to write a diagnostic report file to a path outside its intended permissions, resulting in a confidentiality impact or a bypass of the security boundary the Permission Model is meant to enforce.

Node.js's own upstream advisory scopes this CVE to the currently supported Node.js 22, 24, and 26 release lines, since those are the lines Node.js still patches. The Permission Model feature itself was introduced in Node.js 20, and the same vulnerable code path is also present in the Node.js 20.x line, which reached its own End-of-Life before this CVE was disclosed and so was outside the scope of Node.js's own advisory. HeroDevs' Node.js End-of-Life Security (NES) independently confirmed the flaw on the 20.x line and shipped a post-EOL security fix for it (see Mitigation).

Details

Module Info

• Product: Node.js
• Affected packages: Node.js's own Permission Model implementation, not a bundled third-party dependency
• Affected versions: Node.js 22.x <=22.22.3; Node.js 24.x <=24.16.0; Node.js 26.x <=26.3.0 (per upstream advisory/NVD/CNA scope). The Permission Model was introduced in Node.js 20, and the same code path remains present in the also-affected, now-EOL Node.js 20.x line, which the upstream advisory does not separately name since Node.js no longer supports that line.
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable. Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package.
• Fixed in: Node.js NES v20.20.3 (June 25, 2026); fixed upstream in Node.js 22.23.0, 24.17.0, and 26.3.1 (June 18, 2026)

Vulnerability Info

This Low-severity vulnerability is found in Node.js's built-in process.report module, specifically in the path validation performed before process.report.writeReport() writes a diagnostic report to disk.

The Permission Model, enabled with the --permission flag, is designed so that a process granted only limited (or no) filesystem-write permission cannot write files outside the paths it was explicitly granted. process.report.writeReport() is supposed to respect that same boundary when choosing where to write its output.

Because the destination path is not fully validated against the active Permission Model policy, an attacker who can influence the report's output path or trigger a report write in an affected configuration can cause a report file to be written to a location the policy should have disallowed, exposing information in that report file to unintended readers or bypassing the intended write restriction.

Note: exploitation requires local access, high attack complexity, and user interaction (per the CVSS vector's AC:H/UI:R), and the flaw's own confidentiality impact is low; it does not itself grant arbitrary file write or code execution.

Mitigation

The Node.js 22, 24, and 26 release lines are the currently supported Current/LTS lines and are not End-of-Life. The fix is available upstream in Node.js 22.23.0, 24.17.0, and 26.3.1, all released June 18, 2026.

Node.js 20 reached End-of-Life on April 30, 2026. For more information see Node.js's release schedule. HeroDevs' NES delivered a post-EOL security fix for the Node.js 20.x line, v20.20.3, on June 25, 2026.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.23.0, 24.17.0, 26.3.1, or later, on the supported release lines.
• Upgrade Node.js 20.x deployments to v20.20.3 or later.
• Migrate applications on Node.js 20.x or an earlier End-of-Life line to a supported Node.js release, or engage a commercial support partner like HeroDevs for post-EOL security support through Node.js NES.

Credits

• suul (reporter, per Node.js's official June 2026 security advisory)
• RafaelGSS (remediation developer, from the Node.js project, per the Node.js June 2026 security release notes)