CVE-2026-56847: Node.js Information Disclosure Vulnerability

CVE-2026-56847 Overview

CVE-2026-56847 is a Node.js Permission Model enforcement flaw. The trace_events.createTracing().enable() API writes trace log files to disk without honoring the --allow-fs-write policy. This lets local code operating under a restrictive Permission Model bypass the intended filesystem write boundary [CWE-1119].

The issue affects Node.js 22.x, 24.x, and 26.x release lines. Impact is limited to local, low-privileged contexts and produces integrity impact through unauthorized file writes. The vulnerability does not yield code execution or elevated privileges by itself.

Critical Impact
Local code sandboxed by the Node.js Permission Model can write trace log files outside the --allow-fs-write allowlist, undermining the intended filesystem policy boundary.

Affected Products

Node.js 22.x release line
Node.js 24.x release line
Node.js 26.x release line

Discovery Timeline

2026-07-30 - CVE-2026-56847 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-56847

Vulnerability Analysis

The Node.js Permission Model is an experimental runtime sandbox. It restricts filesystem, child process, and worker access based on flags such as --allow-fs-read and --allow-fs-write. Code executed with the Permission Model enabled is expected to be constrained to the paths declared on the command line.

The trace_events core module produces performance and diagnostic traces. Calling trace_events.createTracing({ categories: [...] }).enable() causes the runtime to open and write a trace log file (typically node_trace.<id>.log) in the current working directory or a configured path. This write occurs through internal C++ bindings that skip the Permission Model policy checks applied to the fs module.

An attacker executing JavaScript inside a Permission Model sandbox can invoke trace_events to place attacker-controlled content on disk at locations the operator did not permit. This breaks the confidentiality of the sandbox boundary and enables unauthorized file writes.

Root Cause

The root cause is missing permission enforcement on the internal trace log writer. The trace_events subsystem writes through a native path that was not gated by the Permission Model check invoked by the standard fs write paths. [CWE-1119] classifies this as an insufficient enforcement issue in the security mechanism.

Attack Vector

Exploitation requires local access and low privileges. The attacker must already run JavaScript inside a Node.js process configured with --permission and a restricted --allow-fs-write set. The attacker calls require('trace_events').createTracing({ categories: ['node'] }).enable() and Node.js writes a trace log outside the permitted paths. No user interaction is required. Refer to the Node.js Security Release Blog for vendor technical detail.

Detection Methods for CVE-2026-56847

Indicators of Compromise

Unexpected node_trace.*.log files appearing on hosts running Node.js applications with the Permission Model enabled.
Node.js processes started with --permission that also emit trace output to paths not listed in --allow-fs-write.

Detection Strategies

Audit running Node.js processes for use of trace_events.createTracing().enable() in code paths that are supposed to run under a restricted Permission Model.
Compare on-disk trace file locations against the --allow-fs-write allowlist declared for each Node.js service.
Review application dependencies for third-party packages that invoke trace_events at runtime.

Monitoring Recommendations

Monitor file creation events for node_trace.*.log outside expected directories using endpoint telemetry.
Alert on Node.js runtime version strings matching vulnerable 22.x, 24.x, or 26.x builds in software inventory data.
Track command-line arguments of Node.js processes to identify services relying on the Permission Model for sandboxing.

How to Mitigate CVE-2026-56847

Immediate Actions Required

Upgrade Node.js to the patched release for the 22.x, 24.x, or 26.x line as published in the July 2026 security releases.
Inventory production workloads that rely on --permission and confirm each host runs a fixed build.
Restrict which local users can execute Node.js binaries on hosts where the Permission Model is the primary sandbox.

Patch Information

Node.js published fixed builds as part of the July 2026 security release cycle. Details, download links, and per-line version numbers are documented in the Node.js Security Release Blog.

Workarounds

Disable or remove application code paths that call trace_events.createTracing().enable() when running under the Permission Model.
Do not rely on the experimental Permission Model as a sole security boundary for untrusted code; combine it with OS-level sandboxing such as containers, seccomp, or AppArmor.
Constrain the working directory of Node.js processes so that unauthorized trace file writes land in a monitored, ephemeral location.

bash

# Verify the installed Node.js version against the July 2026 fixed releases
node --version

# Example: run Node.js with the Permission Model and audit trace_events usage
node --permission \
     --allow-fs-read=/app \
     --allow-fs-write=/app/data \
     /app/server.js