CVE-2026-48936: Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the --allow-net permission.
Other sources
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the --allow-net permission.
This vulnerability affects one supported release line: Node.js 26.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48936?
The severity of CVE-2026-48936 is classified as low, with a score of 3.3.
How do I fix CVE-2026-48936?
To fix CVE-2026-48936, apply the available patch provided in the Node.js security releases.
What does CVE-2026-48936 affect?
CVE-2026-48936 affects the Node.js Permission API in Node.js version 26.
What is the impact of CVE-2026-48936?
CVE-2026-48936 can allow a local server to be started via a Unix domain socket without the necessary permissions.
When was CVE-2026-48936 published?
CVE-2026-48936 was published on June 26, 2026.