CVE-2026-48617

Published: Jun 18, 2026Modified: Aug 19, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: NVD

Description

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected (3)

Products: Nodejs: Node.js

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 22.0.0 to 22.22.3
Nodejs Node.js	From 24.0.0 to 24.16.0
Nodejs Node.js	From 26.0.0 to 26.3.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

http://hackerone.com/reports/3692858

Source: support@hackerone.com

Issue TrackingThird Party Advisory

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Source: support@hackerone.com

Vendor Advisory

Timeline

No history available yet.