PT-2026-52063 · Openjs Foundation+1 · Node.Js+1

Muhammaddaffa

·

CVE-2026-48935

·

Published

2026-06-19

·

Updated

2026-09-03

CVSS v3.1

3.3

Low

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x
Description A flaw in the Node.js Permission API allows file metadata to be modified even when a path is configured as read-only, such as when using the --allow-fs-read flag.
Recommendations Update Node.js 22.x to the latest patched version. Update Node.js 24.x to the latest patched version. Update Node.js 26.x to version 26.3.1-1.1 or later.

Exploit

Fix

Incorrect Default Permissions

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-276

Related Identifiers

ALSA-2026:35841
ALSA-2026:35842
ALSA-2026:35891
ALSA-2026:35892
ALSA-2026:39868
ALSA-2026:41947
AZL-91233
BIT-NODE-2026-48935
BIT-NODE-MIN-2026-48935
CVE-2026-48935
ECHO-C091-93E9-FA66
OPENSUSE-SU-2026:11110-1
OPENSUSE-SU-2026:11121-1
OPENSUSE-SU-2026:21058-1
OPENSUSE-SU-2026:21236-1
RHSA-2026:33866
RHSA-2026:34478
RHSA-2026:35272
RHSA-2026:35841
RHSA-2026:35842
RHSA-2026:35891
RHSA-2026:35892
RHSA-2026:39868
RHSA-2026:7378
RHSA-2026:9455
SUSE-SU-2026:22368-1
SUSE-SU-2026:22565-1
SUSE-SU-2026:2633-1
SUSE-SU-2026:2647-1
SUSE-SU-2026:2695-1
SUSE-SU-2026:3929-1
SUSE-SU-2026:3930-1

Affected Products

Node.Js
Rocky Linux