IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
3.3Niedrig

CVE-2026-48935

nodejs node Veröffentlicht: (vor 4 Monaten)

Beschreibung

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Schwachstellentyp (CWE): CWE-276

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
nodejs node 22.22.3 – ≤ 22.22.3, 24.16.0 – ≤ 24.16.0, 26.3.0 – ≤ 26.3.0
nodejs node.js 22.22.3

Referenzen und Patches

CPE-Treffer (NVD) (3)
  • cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*
  • cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*

Neue CVEs im selben Produkt — Node.js

6.5Mittel
CVE-2026-105481
nodejs node

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected …

7.4Hoch
CVE-2026-105482
nodejs node

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. B…

7.4Hoch
CVE-2026-105483
nodejs node

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIde…

7.4Hoch
CVE-2026-106069
nodejs node

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.chec…

3.6Niedrig
CVE-2026-106071
nodejs node

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops…

3.3Niedrig
CVE-2026-106073
nodejs node

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--p…