CVE-2026-56847 is a low-severity vulnerability in Node.js where the permission model enforcement is flawed. The trace_events.createTracing().enable() function can write trace logs outside the scope restricted by the --allow-fs-write flag, potentially allowing unauthorized file system writes. This could lead to confidentiality issues or bypass of intended security boundaries in affected Node.js versions 22.23.1, 24.18.0, and 26.5.0. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

The vulnerability allows trace logs to be written outside the intended permission boundaries, which may cause confidentiality impacts or security boundary bypass under affected configurations. However, the impact is limited as indicated by the low CVSS score (3.3) and the requirement for local privileges (AV:L) and low privileges (PR:L). There is no indication of availability or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully evaluate the use of trace_events.createTracing().enable() especially in environments where the --allow-fs-write flag is not set. Restricting access to local users and monitoring usage of tracing features may reduce risk.