CVE-2026-48935

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. Since Node.js 20, it has also shipped an experimental Permission Model (enabled with the --permission flag and scoped with flags like --allow-fs-read) that lets an application restrict what a running Node.js process is allowed to access.

A Permission Model bypass (CVE-2026-48935) has been identified in Node.js: file metadata could be modified, via FileHandle.utimes() in the fs.promises API, even on a path that had been marked read-only with a flag such as --allow-fs-read.

This issue affects Node.js 22.x, 24.x, and 26.x, the release lines that ship the Permission Model, as officially scoped by the upstream advisory. The feature does not exist at all in Node.js 12.x, 14.x, 16.x, or 18.x, so those long-EOL lines are inherently unaffected. HeroDevs' Node.js NES release notes for the EOL Node.js 20.x line (which does ship the Permission Model) list this CVE as addressed in NES v20.20.3, released June 25, 2026.

Details

Module Info

• Product: Node.js
• Affected packages: Node.js itself, the built-in, experimental Permission Model's handling of fs.promises.FileHandle.prototype.utimes(), native runtime code, not a separately published npm package
• Affected versions: Node.js 22.x: 22.0.0 through 22.22.3 (fixed 22.23.0); Node.js 24.x: 24.0.0 through 24.16.0 (fixed 24.17.0); Node.js 26.x: 26.0.0 through 26.3.0 (fixed 26.3.1)
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable. Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package.
• Fixed in: NES for Node.js v20.20.3 (Node.js 20.x); upstream Node.js 22.23.0, 24.17.0, 26.3.1

Vulnerability Info

This Low-severity vulnerability (CVSS v3.0 3.3, local attack vector) is found in Node.js's experimental Permission Model, in all Node.js 22.x, 24.x, and 26.x builds prior to the fixed versions above.

When a Node.js process is started with the Permission Model enabled and a path is granted only read access (for example --permission --allow-fs-read=/data), the model is supposed to reject any operation on that path that would write to it or change it, including metadata-only writes.

FileHandle.prototype.utimes() (the fs.promises/filehandle API for updating a file's access and modification timestamps) did not check the Permission Model's write grant before applying the timestamp change. A script running under a read-only grant could therefore still modify a file's mtime/atime on a path it should not be able to write to at all — an incorrect default/enforced permission (CWE-276) that lets code bypass a security boundary the embedding application relied on. The fix, "permission: disable FileHandle utimes with permission model" (commit 28dcd38864), blocks the call when the Permission Model denies write access to the target path.

Note: the impact is limited to file metadata (timestamps), not file contents, and only applies to processes that opt into the experimental Permission Model.

Mitigation

This CVE was disclosed in Node.js's coordinated June 18, 2026 security release, and the upstream advisory scopes it to the currently-supported Node.js 22.x, 24.x, and 26.x (Current) lines, which are the only lines that ship the Permission Model:

• Users on Node.js 22.x should upgrade to 22.23.0 or later.
• Users on Node.js 24.x should upgrade to 24.17.0 or later.
• Users on the Node.js 26.x Current line should upgrade to 26.3.1 or later.

No upstream fix exists for any End-of-Life Node.js line, since the Permission Model was introduced in Node.js 20.0.0 and only Node.js 20.x among the EOL lines ships it. HeroDevs' Node.js NES release notes list this CVE as fixed in NES v20.20.3, released June 25, 2026. Node.js 20.x reached End-of-Life on April 30, 2026.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.23.0, 24.17.0, or 26.3.1 or later.
• If still running the End-of-Life Node.js 20.x line, upgrade to NES 20.20.3 or later, or migrate to a supported line.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• muhammaddaffa (reporter)
• RafaelGSS (remediation developer)