CVE-2026-56847

Summary

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Affected Software

Weaknesses

• CWE-1119: CWE-1119 Excessive Use of Unconditional Branching

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

• ←Previous
• Next→