CVE-2026-56847

LowCVSS 3.3

Published: 30/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() to write trace logs outside the --allow-fs-write boundary.

Risk Assessment

An attacker can bypass permission model restrictions, potentially leading to data leakage or security boundary violation.

Recommendation

Update Node.js to the latest patched version for your channel (22.x, 24.x, or 26.x).

Original NVD description (English source)

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.