CVE-2026-48936

Not yet scoredAwaiting CVSS assessment

Published

June 26, 2026

Affected

11 projects

Assigned by

Description

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

@externs/nodejs

NPMThe Closure Compiler Externs For Node.JS.

= 26.3.0NVD

externs/nodejs

GitHubThe Externs For Node.JS.

= 26.3.0NVD

@depack/nodejs

NPM

More on this CVE

NVD↗GitHub Advisory↗

Mocks Of Built-In Node.JS Modules To Use For Compilation.

= 26.3.0NVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

= 26.3.0NVD

dpck/nodejs

GitHubMocks Of Built-In Node.JS Modules To Use For Compilation.

= 26.3.0NVD

nodejs

Python Package IndexPython bindings and utils for Node.js and io.js

= 26.3.0NVD

nodejs

NPM

= 26.3.0NVD

nodejs

Crates.ioEmbedding Node.js in Rust

= 26.3.0NVD

node.js

NPMsecurity holding package

= 26.3.0NVD

Node.js

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

= 26.3.0NVD

nodejs

Debian Bookwormevented I/O for V8 javascript - runtime executable

= 26.3.0NVD

Security Advisories

CVE-2026-48936

Description

More on this CVE