PT-2026-50702 · Node.Js · Node

Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-48617

Mitre

CVSS v3.1

1.8

Baixa

Vetor base

AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport() Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-48617

Produtos afetados

Node

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48617 · Nota de Segurança
• http://hackerone.com/reports/3692858 · Nota
• https://nodejs.org/en/blog/vulnerability/june-2026-security-releases · Nota