CVE-2026-56847

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x

Description A flaw in the Permission Model enforcement allows the trace events.createTracing().enable() function to write trace logs outside the boundaries defined by the --allow-fs-write flag. This issue can result in a confidentiality impact or a bypass of the intended security boundary under affected configurations.

Recommendations Update Node.js 22.x to a version containing the fix. Update Node.js 24.x to version 24.18.1-1.1 or later. Update Node.js 26.x to version 26.5.1-1.1 or later.