IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
3.3Düşük

CVE-2026-56847

nodejs node Yayım: (3 ay önce)

Açıklama

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

Zayıflık türü (CWE): CWE-1119

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
nodejs node 26.5.0 – ≤ 26.5.0, 24.18.0 – ≤ 24.18.0, 22.23.1 – ≤ 22.23.1
nodejs node.js 22.0 – ≤ 22.23.1

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (3)
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 22.0 ≤ 22.23.1
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 24.0.0 ≤ 24.18.0
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 26.0.0 ≤ 26.5.0

Aynı üründe son açıklar — Node.js

6.5Orta
CVE-2026-105481
nodejs node

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected …

7.4Yüksek
CVE-2026-105482
nodejs node

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. B…

7.4Yüksek
CVE-2026-105483
nodejs node

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIde…

7.4Yüksek
CVE-2026-106069
nodejs node

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.chec…

3.6Düşük
CVE-2026-106071
nodejs node

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops…

3.3Düşük
CVE-2026-106073
nodejs node

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--p…