CVE-2026-48617

Published: Jun 18, 2026Modified: Jun 22, 2026

1.8

Vector

CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Exploitability: 0.3 / Impact: 1.4

Source: support@hackerone.com (Secondary)

Description

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

http://hackerone.com/reports/3692858

Source: support@hackerone.com

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Source: support@hackerone.com

Timeline

No history available yet.