Skip to content
Fencer Vulns
low 3.3

CVE-2026-48936 json

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissi…

published 2026-06-26 4 mo ago modified 2026-10-25 14 d ago also BIT-node-2026-48936 , BIT-node-min-2026-48936 , EUVD-2026-39611

cvss
3.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.

This vulnerability affects one supported release line: **Node.js 26**.

Patch / fix

  • bitnami node 26.3.1
  • bitnami node-min 26.3.1
  • nodejs22 hummingbird 1 22.23.1-2.hum1
  • nodejs22-bin hummingbird 1 22.23.1-2.hum1
  • nodejs22-npm hummingbird 1 10.9.8-1.22.23.1.2.hum1
  • nodejs22-libs hummingbird 1 22.23.1-2.hum1
  • nodejs22-npm-bin hummingbird 1 22.23.1-2.hum1
  • nodejs22-full-i18n hummingbird 1 22.23.1-2.hum1
  • nodejs24 hummingbird 1 24.18.0-0.2.hum1
  • nodejs24-bin hummingbird 1 24.18.0-0.2.hum1

red hat advisories RHSA-2026:35272RHSA-2026:34478RHSA-2026:33866RHSA-2026:9455RHSA-2026:7378

  • nodejs26 openSUSE Tumbleweed 26.3.1-1.1

opensuse advisories openSUSE-SU-2026:11110-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-48936 updated cvss 3.3

nodejs: Node.js: Local server can be started without network permission via Permission API flaw

  • Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Enterprise Linux 10 nodejs26 26.1.0-1.el10
    affected: workaround, no fix available
  • Red Hat Hardened Images nodejs20 20.20.2-1.hum1, nodejs22 22.23.1-2.hum1, nodejs25 25.9.0-1.1.hum1, nodejs26 26.4.0-1.3.hum1, nodejs24 24.18.0-0.2.hum1, nodejs20-bin 20.20.2-1.hum1, +24 more
    fixed: vendor fix RHSA-2026:9455
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Enterprise Linux 10 nodejs22, nodejs24 Red Hat Hardened Images v8-11.3-devel 11.3.244.8-1.20.20.2.1.hum1, v8-12.4-devel 12.4.254.21-1.22.23.1.2.hum1, v8-14.1-devel 14.1.146.11-1.25.9.0.1.1.hum1, v8-14.6-devel 14.6.202.34-1.26.4.0.1.3.hum1, v8-13.6-devel 13.6.233.17-1.24.18.0.0.2.hum1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
OSV 3.0 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami node
>=26.3.0, <26.3.1
26.3.1
bitnami node-min
>=26.3.0, <26.3.1
26.3.1

Affected products

  • nodejs node

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.