CVE-2026-48936: Node.js Privilege Escalation Vulnerability

CVE-2026-48936 Overview

CVE-2026-48936 is a permission model bypass in Node.js. The flaw allows a local server to start via a Unix domain socket without the --allow-net permission being granted. The Permission API is intended to enforce runtime restrictions on network, file system, and child process operations. This vulnerability breaks that contract for Unix domain sockets, letting untrusted code create local listening endpoints outside policy. Only the Node.js 26 release line is affected, specifically version 26.3.0. The issue is tracked under CWE-284: Improper Access Control and carries a CVSS score of 3.3 with a local attack vector.

Critical Impact
Untrusted code running under the Node.js Permission Model can bypass --allow-net restrictions and open a local Unix domain socket server, enabling unauthorized local inter-process communication.

Affected Products

Node.js 26.3.0
Node.js 26.x release line (prior to the June 2026 security release)
Applications relying on the --allow-net permission flag for isolation

Discovery Timeline

2026-06-26 - CVE-2026-48936 published to NVD
2026-06-26 - Node.js June 2026 Security Release published
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-48936

Vulnerability Analysis

Node.js 26 introduced a Permission Model that restricts runtime capabilities using flags such as --allow-fs-read, --allow-fs-write, --allow-child-process, and --allow-net. The --allow-net flag governs whether code may create network listeners or outbound connections. In the affected release, the Permission API does not gate the creation of a listening server bound to a Unix domain socket path. Code executing under a restrictive policy can therefore call server listen routines targeting a UDS path and successfully accept connections. The result is a bypass of the intended network isolation boundary within the same host.

Root Cause

The root cause is an incomplete permission check in the Node.js Permission API. Network permission enforcement covers TCP and UDP endpoints but omits Unix domain socket endpoints from the same policy path. This falls under [CWE-284: Improper Access Control], where an access control decision is missing for a semantically equivalent operation.

Attack Vector

Exploitation requires local code execution inside a Node.js 26 process running with the Permission Model enabled but without --allow-net. An attacker who controls sandboxed JavaScript, such as a malicious dependency or plugin, can instantiate a net.Server or http.Server listening on a UDS path. Other local processes or co-located code can then connect to that socket. No user interaction is required, and privileges required are limited to those of the Node.js process.

No verified public exploit code is available. See the Node.js June 2026 Security Blog for the vendor's technical description.

Detection Methods for CVE-2026-48936

Indicators of Compromise

Unix domain socket files created by a Node.js process running under --permission without --allow-net
Unexpected listen() syscalls targeting AF_UNIX sockets from Node.js 26.3.0 binaries
New socket file descriptors under application working directories or /tmp associated with sandboxed Node.js workloads

Detection Strategies

Inventory running Node.js processes and flag any at version 26.3.0 using node --version or process telemetry.
Audit process command lines for --permission invocation combined with the absence of --allow-net, then correlate with socket creation events.
Use Linux audit rules or eBPF-based tooling to log bind() calls on AF_UNIX sockets originating from Node.js processes.

Monitoring Recommendations

Alert on creation of new .sock files in application directories by Node.js runtimes.
Track child processes and IPC channels associated with sandboxed Node.js workloads for policy drift.
Feed process, file, and socket telemetry from Node.js hosts into a centralized data lake for retrospective hunting after upgrade.

How to Mitigate CVE-2026-48936

Immediate Actions Required

Upgrade Node.js 26 installations to the patched release listed in the Node.js June 2026 Security Blog.
Identify all workloads pinned to node:26.3.0 in container images, CI pipelines, and package manifests, and rebuild against the patched version.
Review applications that depend on --allow-net for isolation and verify no untrusted code created persistent UDS endpoints.

Patch Information

Node.js released fixed builds as part of the June 2026 security releases. Refer to the Node.js June 2026 Security Blog for exact patched versions and download links. Node.js LTS lines other than 26 are not affected.

Workarounds

Avoid relying solely on the Permission Model for network isolation in Node.js 26.3.0; combine it with OS-level controls such as seccomp, AppArmor, or SELinux profiles that deny AF_UNIX socket creation.
Run untrusted Node.js code inside containers with read-only file systems and restricted tmpfs mounts to prevent UDS file creation.
Restrict filesystem write permissions with --allow-fs-write to specific paths that exclude directories usable for socket files.

bash

# Verify Node.js version and upgrade
node --version
# If output is v26.3.0, upgrade to the patched release
# See https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

# Example hardened launch combining Permission Model with seccomp
systemd-run --property=SystemCallFilter=~@network-io \
  node --permission --allow-fs-read=/app app.js