CVE-2026-48935

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://nodejs.org/en/blog/vulnerability/june-2026-security-releases	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nodejs:node.js:22.22.3::::-:::
	cpe:2.3:a:nodejs:node.js:24.16.0::::-:::
	cpe:2.3:a:nodejs:node.js:26.3.0::::-:::

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Un fallo en la API de Permisos de Node.js puede provocar que los metadatos de un archivo se modifiquen incluso en una ruta que se configuró como de solo lectura con, por ejemplo, “--allow-fs-read”. Esta vulnerabilidad afecta a todas las líneas de lanzamiento compatibles: Node.js 22, Node.js 24, y Node.js 26.

Information

Published : 2026-06-26 02:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-48935

Mitre link : CVE-2026-48935

CVE.ORG link : CVE-2026-48935

JSON object : View

Products Affected

nodejs

node.js

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2026-48935", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48935", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T15:04:33.702023Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "22.22.3", "versionType": "semver", "lessThanOrEqual": "22.22.3"}, {"status": "affected", "version": "24.16.0", "versionType": "semver", "lessThanOrEqual": "24.16.0"}, {"status": "affected", "version": "26.3.0", "versionType": "semver", "lessThanOrEqual": "26.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-26T02:16:53.050", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "tags": ["Patch", "Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."}, {"lang": "es", "value": "Un fallo en la API de Permisos de Node.js puede provocar que los metadatos de un archivo se modifiquen incluso en una ruta que se configur\u00f3 como de solo lectura con, por ejemplo, \u201c--allow-fs-read\u201d.\n\nEsta vulnerabilidad afecta a todas las l\u00edneas de lanzamiento compatibles: Node.js 22, Node.js 24, y Node.js 26."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "3C0C5080-5F99-4651-9855-2DE03C9070C5"}, {"criteria": "cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "3B912C84-1AA5-4D74-AB1A-64162C80A33B"}, {"criteria": "cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "8152ACE6-3CAF-4CA0-8B19-D4753811EB44"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}