CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read.
Other sources
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0Fixed in 24.17.0Fixed in 26.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48935?
The severity of CVE-2026-48935 is rated as low with a score of 3.3.
How do I fix CVE-2026-48935?
To fix CVE-2026-48935, update Node.js to the latest secure release version.
Which versions of Node.js are affected by CVE-2026-48935?
CVE-2026-48935 affects all supported release lines including Node.js 22, Node.js 24, and Node.js 26.
What type of vulnerability is CVE-2026-48935?
CVE-2026-48935 is a flaw in the Node.js Permission API that can allow unauthorized modification of file metadata.
What is the attack vector for CVE-2026-48935?
The attack vector for CVE-2026-48935 is local, as it involves user permissions through the Node.js Permission API.