CVE-2026-48935: Low severity Node.js 22 vulnerability
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodejsto a version that resolves this vulnerability.Fixed in 22 - Upgrade
Upgrade
nodejsto a version that resolves this vulnerability.Fixed in 24 - Upgrade
Upgrade
nodejsto a version that resolves this vulnerability.Fixed in 26 - Configuration
Do not run Node.js with the `--allow-fs-read` option on affected versions; avoid allowing read access to the filesystem if it is not required.
Node.js (Permission API / fs access policy) --allow-fs-read = do not use (remove the flag)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48935?
The severity of CVE-2026-48935 is rated as low with a score of 3.3.
How do I fix CVE-2026-48935?
To fix CVE-2026-48935, update Node.js to the latest secure release version.
Which versions of Node.js are affected by CVE-2026-48935?
CVE-2026-48935 affects all supported release lines including Node.js 22, Node.js 24, and Node.js 26.
What type of vulnerability is CVE-2026-48935?
CVE-2026-48935 is a flaw in the Node.js Permission API that can allow unauthorized modification of file metadata.
What is the attack vector for CVE-2026-48935?
The attack vector for CVE-2026-48935 is local, as it involves user permissions through the Node.js Permission API.