CVE-2026-48617 in Node.js 22.16.0
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
- Severity
- High 8.2
- Exploitation
-
0% chance of exploit
in the next 30 days - Fix
- No fixed version listed yet
- Where
- App / API
- How it matched
- Exact version match
- First seen
- 2026-11-05 01:13:58 UTC
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2026-48617