CVE-2026-48935: Node.js Privilege Escalation Vulnerability

CVE-2026-48935 Overview

CVE-2026-48935 is a permission model flaw in the Node.js Permission API. The vulnerability allows a local process to modify file metadata on a path that was explicitly restricted to read-only access through the --allow-fs-read flag. The issue affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. The weakness is classified under [CWE-276] Incorrect Default Permissions and enables partial integrity impact against files that the operator intended to be immutable through the permission model.

Critical Impact
A local attacker with the ability to run code inside a permission-restricted Node.js process can alter file metadata on paths granted read-only access, undermining the integrity guarantees of the --allow-fs-read policy.

Affected Products

Node.js 22 (identified build 22.22.3)
Node.js 24 (identified build 24.16.0)
Node.js 26 (identified build 26.3.0)

Discovery Timeline

2026-06-26 - CVE-2026-48935 published to NVD
2026-06-26 - Node.js publishes June 2026 security releases blog
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-48935

Vulnerability Analysis

The Node.js Permission API lets operators constrain a process to a defined filesystem policy using flags such as --allow-fs-read and --allow-fs-write. Paths passed to --allow-fs-read are intended to be readable but not modifiable. CVE-2026-48935 breaks that guarantee for file metadata operations. Code running inside the sandboxed process can call metadata-changing APIs on a read-only path and the Permission API fails to reject the operation. The result is a local integrity violation without any impact on confidentiality or availability, consistent with the assigned CVSS partial-integrity vector.

Root Cause

The root cause is incomplete enforcement in the Permission API's authorization checks for metadata-mutating filesystem operations. The permission model correctly gates content read and write paths but does not consistently route metadata modifications (such as ownership, timestamps, or attribute changes) through the write-permission check. Paths granted only --allow-fs-read therefore accept metadata changes that should be denied.

Attack Vector

Exploitation requires local access and the ability to execute JavaScript inside a Node.js process that uses the Permission API. An attacker who controls untrusted code loaded into such a process, for example a plugin, third-party dependency, or supply-chain payload, can invoke a metadata-changing filesystem call against a read-only path. The Permission API allows the call, and the metadata on the target file is modified. No user interaction is required. Refer to the Node.js June 2026 Vulnerability Blog for vendor technical details.

Detection Methods for CVE-2026-48935

Indicators of Compromise

Unexpected changes to timestamps, ownership, or extended attributes on files inside directories passed to --allow-fs-read.
Node.js process command lines that include --allow-fs-read but no matching --allow-fs-write for a path whose metadata subsequently changed.
Audit records showing metadata syscalls (utimensat, chmod, chown) originating from a Node.js process that should be operating read-only.

Detection Strategies

Enable filesystem auditing (Linux auditd, macOS fs_usage, Windows object access auditing) on directories protected by the Permission API and alert on metadata mutations from Node.js binaries.
Baseline the Node.js versions in use across the environment and flag hosts still running 22.22.3, 24.16.0, or 26.3.0.
Correlate process telemetry from Node.js runtimes with filesystem metadata change events to identify policy violations.

Monitoring Recommendations

Continuously inventory Node.js versions in production, CI runners, and developer workstations.
Monitor for new or unsigned modules loaded into Node.js processes that rely on the Permission API to sandbox untrusted code.
Track file integrity on sensitive read-only paths using a file integrity monitoring tool and alert on metadata deltas.

How to Mitigate CVE-2026-48935

Immediate Actions Required

Upgrade Node.js to the fixed releases published in the Node.js June 2026 security releases for the 22, 24, and 26 lines.
Audit all invocations of Node.js that rely on --allow-fs-read to enforce read-only guarantees and identify any exposure.
Restrict which code can be loaded into permission-restricted Node.js processes until patched builds are deployed.

Patch Information

Node.js has issued patched builds across the 22, 24, and 26 release lines as part of the June 2026 security releases. The vulnerable versions identified in the CPE data are 22.22.3, 24.16.0, and 26.3.0. Operators should upgrade to the next release on each line as documented in the vendor advisory.

Workarounds

Treat the Permission API as a defense-in-depth control rather than a hard boundary against local code until patches are applied.
Use operating system-level controls such as read-only mounts, mandatory access control policies (SELinux, AppArmor), or filesystem ACLs to enforce true immutability on sensitive paths.
Reduce the trust surface by limiting third-party dependencies loaded into Node.js processes that handle sensitive filesystem paths.

bash

# Verify the Node.js runtime version on affected hosts
node --version

# Example of enforcing read-only at the OS layer as a compensating control (Linux)
mount -o remount,ro /path/to/sensitive/data