1.8Düşük

CVE-2026-48617

nodejs node Yayım: 2026-06-18 19:21 (4 ay önce)

Açıklama

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Zayıflık türü (CWE): CWE-284

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
nodejs	node	22.22.3 – ≤ 22.22.3, 24.16.0 – ≤ 24.16.0, 26.3.0 – ≤ 26.3.0
nodejs	node.js	22.0.0 – ≤ 22.22.3

Kaynaklar ve yamalar

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases Vendor Advisory
http://hackerone.com/reports/3692858 Issue TrackingThird Party Advisory

CPE eşleşmeleri (NVD) (3)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 22.0.0 ≤ 22.22.3
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 24.0.0 ≤ 24.16.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 26.0.0 ≤ 26.3.0

CVSS puanı

1.8Düşük

Kaynak: hackerone · CVSS 3.0

Saldırı yolu: Yerel
Karmaşıklık: Yüksek
Gereken yetki: Yüksek
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Tüm puanlar (3)

cna	CVSS 3.0	1.8Düşük
nvd	CVSS 3.1	8.2Yüksek
support@hackerone.com	CVSS 3.0	1.8Düşük

EPSS (30 günde istismar olasılığı)

0.32%

tüm CVE'lerin %25'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-05-22
Yayımlandı2026-06-18 19:21
IP-DB'ye ulaştı2026-10-24 23:44
Son güncelleme2026-10-26 14:10

Numarayı veren (CNA): hackerone
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Node.js

7.5Yüksek

CVE-2026-126051 4 saat önce

Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

nodejs node

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server…

5.9Orta

CVE-2026-123875 4 saat önce

Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled

nodejs node

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cance…

7.5Yüksek

CVE-2026-123874 4 saat önce

Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write

nodejs node

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write reques…

8.1Yüksek

CVE-2026-123872 4 saat önce

Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

nodejs node

A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example s…

6.8Orta

CVE-2026-123877 4 saat önce

Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse

nodejs node

A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request t…

6.2Orta

CVE-2026-123871 4 saat önce

Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages

nodejs node

Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed fou…