CVE-2026-48936

Summary

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the --allow-net permission.

This vulnerability affects one supported release line: Node.js 26.

Affected Software

Weaknesses

• CWE-284: CWE-284 Improper Access Control - Generic

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

• ←Previous
• Next→