CVE-2026-48936

LOW3.3

A flaw in Node

Published Jun 26, 2026

Modified 1 months ago

Details

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the --allow-net permission.

This vulnerability affects one supported release line: Node.js 26.

Affected Packages

Node.js

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

References

CVSS Analysis

CVSS v3.0

3.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

3.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness Type (CWE)

Configuration

Ecosystems(22)

Timeline

PublishedJun 26, 2026

ModifiedJun 26, 2026