CVE-2026-48936

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://nodejs.org/en/blog/vulnerability/june-2026-security-releases	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Un defecto en la API de Permisos de Node.js puede provocar que se inicie un servidor local (a través de un socket de dominio Unix), incluso sin el permiso “--allow-net”. Esta vulnerabilidad afecta a una línea de lanzamiento compatible: Node.js 26.

Information

Published : 2026-06-26 02:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-48936

Mitre link : CVE-2026-48936

CVE.ORG link : CVE-2026-48936

JSON object : View

Products Affected

nodejs

node.js

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-48936", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48936", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:35:18.745870Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "26.3.0", "versionType": "semver", "lessThanOrEqual": "26.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-26T02:16:53.157", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "tags": ["Patch", "Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.\r\n\r\nThis vulnerability affects one supported release line: **Node.js 26**."}, {"lang": "es", "value": "Un defecto en la API de Permisos de Node.js puede provocar que se inicie un servidor local (a trav\u00e9s de un socket de dominio Unix), incluso sin el permiso \u201c--allow-net\u201d.\n\nEsta vulnerabilidad afecta a una l\u00ednea de lanzamiento compatible: Node.js 26."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "8152ACE6-3CAF-4CA0-8B19-D4753811EB44"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}