Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2026-48935 | Release Alert

CVE-2026-48935

Not yet scoredAwaiting CVSS assessment

Published

June 26, 2026

Affected

11 projects

Assigned by

[email protected]

Description

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

@externs/nodejs

NPMThe Closure Compiler Externs For Node.JS.

= 22.22.3, = 24.16.0, = 26.3.0NVD

GitHubThe Externs For Node.JS.

= 22.22.3, = 24.16.0, = 26.3.0NVD

NPM

More on this CVE

NVD↗GitHub Advisory↗

Mocks Of Built-In Node.JS Modules To Use For Compilation.

= 22.22.3, = 24.16.0, = 26.3.0NVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

= 22.22.3, = 24.16.0, = 26.3.0NVD

GitHubMocks Of Built-In Node.JS Modules To Use For Compilation.

= 22.22.3, = 24.16.0, = 26.3.0NVD

Python Package IndexPython bindings and utils for Node.js and io.js

= 22.22.3, = 24.16.0, = 26.3.0NVD

NPM

= 22.22.3, = 24.16.0, = 26.3.0NVD

Crates.ioEmbedding Node.js in Rust

= 22.22.3, = 24.16.0, = 26.3.0NVD

NPMsecurity holding package

= 22.22.3, = 24.16.0, = 26.3.0NVD

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

= 22.22.3, = 24.16.0, = 26.3.0NVD

Debian Bookwormevented I/O for V8 javascript - runtime executable

= 22.22.3, = 24.16.0, = 26.3.0NVD