CVE-2026-56847
6.1
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Exploitability: 1.8 / Impact: 4.2
Source: NVD
Description
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Affected (3)
References (1)
Source: support@hackerone.com
Vendor Advisory
Timeline
No history available yet.