CVE-2026-56847

Name
CVE-2026-56847
Description
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
support@hackerone.com https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 22.0 <= 22.23.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 24.0.0 <= 24.18.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 26.0.0 <= 26.5.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nodejs-current edge-community 26.7.0-r0 Johannes Müller <alpinelinux@jogemu.at> fixed
nodejs-current 3.24-community 26.5.1-r0 Johannes Müller <alpinelinux@jogemu.at> fixed
nodejs edge-main 24.18.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs edge-main 24.18.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.16.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.15.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.14.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.14.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.14.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.14.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.11.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.11.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.11.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.21.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.19.0-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.19.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r5 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.11.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.11.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.11.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.24-main 24.18.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs 3.24-main 24.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.24-main 24.16.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.23-main 24.18.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs 3.23-main 24.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.23-main 24.14.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.23-main 24.13.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.23-main 24.13.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.23-main 24.11.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.23.2-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs 3.22-main 22.23.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.22.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.22.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.16.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.13.1-r0 None possibly vulnerable
nodejs 3.21-main 22.23.2-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs 3.21-main 22.23.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.22.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.15.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.13.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.11.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.11.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable