Nodejs: A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. (CVE-2026-48935)
Description
A vulnerability in the Node.js Permission API allows modification of file metadata on paths set as read-only, such as those restricted with the --allow-fs-read flag. This affects multiple supported Node.js release lines including versions 22.22.3 up to but not including 22.23.0, 24.16.0 up to but not including 24.17.0, and 26.3.0 up to but not including 26.3.1, as well as several specific Ubuntu package versions. The severity is considered medium with a CVSS score of 3.3. A patch is available to address this vulnerability.
CVSS v3.0
Score 3.3low
Affected software
pkg:bitnami/nodepkg:deb/ubuntu/nodejs?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/nodejs?arch=source&distro=noblepkg:deb/ubuntu/nodejs?arch=source&distro=questingpkg:deb/ubuntu/nodejs?arch=source&distro=stonkingpkg:deb/ubuntu/nodejs?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48935 describes a flaw in the Node.js Permission API where file metadata can be modified even on paths that are set as read-only, for example when restricted using the --allow-fs-read flag. This affects multiple Node.js release lines: >=22.22.3 <22.23.0, >=24.16.0 <24.17.0, >=26.3.0 <26.3.1, and specific Ubuntu package versions of Node.js 18.x and 20.x. The vulnerability has a CVSS 3.0 base score of 3.3, indicating low to medium severity, with impact limited to integrity (modification of file metadata) and no confidentiality or availability impact. A patch is available to fix this issue.
Potential Impact
The vulnerability allows an attacker with limited privileges (local access with low privileges) to modify file metadata on paths that are intended to be read-only. This could lead to integrity issues but does not affect confidentiality or availability. The impact is limited and the severity is rated medium.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade affected Node.js versions to the fixed releases: versions 22.23.0 or later, 24.17.0 or later, and 26.3.1 or later. For Ubuntu package versions listed, users should apply the corresponding security updates provided by their distribution. No additional mitigation is required beyond applying the official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2026-48935
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-48935"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Low
- State
- PUBLISHED
Threat ID: 6aa005f8acd9273b49ab6857
Added to database: 09/08/2026, 12:56:24 UTC
Last enriched: 10/18/2026, 05:33:00 UTC
Last updated: 10/23/2026, 15:10:13 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.