Vulnerabilities

CVSS

8.4 High

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Risk score

67.2

Published

2026-07-30

Status

Analyzed

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

Weaknesses

CWE-284

Coverage 1

vulnerability

Multiples vulnérabilités dans Node.js (30 juillet 2026)

Multiple vulnerabilities have been discovered in Node.js, impacting versions 22.x, 24.x, and 26.x prior to the specified release dates. These vulnerabilities can lead to data integrity compromise, data confidentiality is…

CERT-FR · Jul 30, 2026 Medium

CVE-2026-48934CVE-2026-56846CVE-2026-56847nodejsvulnerabilitysecurity

All articles mentioning it

Advisories and references

• nodejs.org/en/blog/vulnerability/july-2026-security-releases