CVE-2026-48617CWE-284broken-access-control

CVE-2026-48617

High · published June 18, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00317 · 23.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-18T21:16Z
Affected products (3)
ProductVersionsFixed in
nodejs/node.js≥ 22.0.0, ≤ 22.22.3—
nodejs/node.js≥ 24.0.0, ≤ 24.16.0—
nodejs/node.js≥ 26.0.0, ≤ 26.3.0—
References (2)
http://hackerone.com/reports/3692858 · [email protected]https://nodejs.org/en/blog/vulnerability/june-2026-security-releases · [email protected]
EPSS history
Timeline
  • 18 JUN 16:21Z
    A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation
    cvelistv5