A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. (CVE-2026-48935)
A vulnerability in the Node.js Permission API allows modification of file metadata on paths set as read-only, such as those restricted with the --allow-fs-read flag. This issue affects multiple supported Node.js release lines, specifically versions 22.22.3 up to but not including 22.23.0, 24.16.0 up to but not including 24.17.0, and 26.3.0 up to but not including 26.3.1. The severity of this flaw is considered low. A patch is available to address this vulnerability.
AI Analysis
Technical Summary
CVE-2026-48935 describes a flaw in the Node.js Permission API where file metadata can be modified even on paths designated as read-only, for example when using the --allow-fs-read option. This affects Node.js versions in the ranges >=22.22.3 <22.23.0, >=24.16.0 <24.17.0, and >=26.3.0 <26.3.1. The vulnerability has a low severity rating and no CVSS score is provided. No known exploits are reported in the wild. A patch is available for the affected versions.
Potential Impact
The vulnerability allows modification of file metadata on paths that should be read-only, potentially undermining file integrity protections. However, the impact is rated low, indicating limited risk or difficulty in exploitation. There are no reports of active exploitation.
Mitigation Recommendations
A patch is available for the affected Node.js versions. Users should upgrade to versions 22.23.0 or later, 24.17.0 or later, and 26.3.1 or later to remediate this issue.
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. (CVE-2026-48935)
Description
A vulnerability in the Node.js Permission API allows modification of file metadata on paths set as read-only, such as those restricted with the --allow-fs-read flag. This issue affects multiple supported Node.js release lines, specifically versions 22.22.3 up to but not including 22.23.0, 24.16.0 up to but not including 24.17.0, and 26.3.0 up to but not including 26.3.1. The severity of this flaw is considered low. A patch is available to address this vulnerability.
Affected software
pkg:bitnami/nodeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48935 describes a flaw in the Node.js Permission API where file metadata can be modified even on paths designated as read-only, for example when using the --allow-fs-read option. This affects Node.js versions in the ranges >=22.22.3 <22.23.0, >=24.16.0 <24.17.0, and >=26.3.0 <26.3.1. The vulnerability has a low severity rating and no CVSS score is provided. No known exploits are reported in the wild. A patch is available for the affected versions.
Potential Impact
The vulnerability allows modification of file metadata on paths that should be read-only, potentially undermining file integrity protections. However, the impact is rated low, indicating limited risk or difficulty in exploitation. There are no reports of active exploitation.
Mitigation Recommendations
A patch is available for the affected Node.js versions. Users should upgrade to versions 22.23.0 or later, 24.17.0 or later, and 26.3.1 or later to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2026-48935
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-48935"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Low
- Cvss Version
- null
Threat ID: 6aa005f8acd9273b49ab6857
Added to database: 09/08/2026, 12:56:24 UTC
Last enriched: 09/08/2026, 13:34:51 UTC
Last updated: 09/08/2026, 16:23:51 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.