CVE-2026-48936
Fixed in a distro release EPSS <1%CVSS 3.3
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat hummingbird 1 | nodejs20 | 0:20.20.2-1.hum1 |
| Red Hat hummingbird 1 | nodejs20-bin | 0:20.20.2-1.hum1 |
| Red Hat hummingbird 1 | nodejs20-devel | 0:20.20.2-1.hum1 |
| Red Hat hummingbird 1 | nodejs20-docs | 0:20.20.2-1.hum1 |
| Red Hat hummingbird 1 | nodejs20-full-i18n | 0:20.20.2-1.hum1 |
| Red Hat hummingbird 1 | nodejs20-libs | 0:20.20.2-1.hum1 |
| Red Hat hummingbird 1 | nodejs20-npm | 0:10.8.2-1.20.20.2.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-npm-bin | 0:20.20.2-1.hum1 |
| Red Hat hummingbird 1 | nodejs22 | 0:22.23.1-2.hum1 |
| Red Hat hummingbird 1 | nodejs22-bin | 0:22.23.1-2.hum1 |
| Red Hat hummingbird 1 | nodejs22-devel | 0:22.23.1-2.hum1 |
| Red Hat hummingbird 1 | nodejs22-docs | 0:22.23.1-2.hum1 |
| Red Hat hummingbird 1 | nodejs22-full-i18n | 0:22.23.1-2.hum1 |
| Red Hat hummingbird 1 | nodejs22-libs | 0:22.23.1-2.hum1 |
| Red Hat hummingbird 1 | nodejs22-npm | 0:10.9.8-1.22.23.1.2.hum1 |
| Red Hat hummingbird 1 | nodejs22-npm-bin | 0:22.23.1-2.hum1 |
| Red Hat hummingbird 1 | nodejs24 | 0:24.18.0-0.2.hum1 |
| Red Hat hummingbird 1 | nodejs24-bin | 0:24.18.0-0.2.hum1 |
| Red Hat hummingbird 1 | nodejs24-devel | 0:24.18.0-0.2.hum1 |
| Red Hat hummingbird 1 | nodejs24-docs | 0:24.18.0-0.2.hum1 |
| Red Hat hummingbird 1 | nodejs24-full-i18n | 0:24.18.0-0.2.hum1 |
| Red Hat hummingbird 1 | nodejs24-libs | 0:24.18.0-0.2.hum1 |
| Red Hat hummingbird 1 | nodejs24-npm | 0:11.16.0-1.24.18.0.0.2.hum1 |
| Red Hat hummingbird 1 | nodejs24-npm-bin | 0:24.18.0-0.2.hum1 |
| Red Hat hummingbird 1 | nodejs25 | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-bin | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-devel | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-docs | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-full-i18n | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-libs | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-npm | 0:11.12.1-1.25.9.0.1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-npm-bin | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs26 | 0:26.4.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs26-bin | 0:26.4.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs26-devel | 0:26.4.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs26-docs | 0:26.4.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs26-full-i18n | 0:26.4.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs26-libs | 0:26.4.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs26-npm | 0:11.17.0-1.26.4.0.1.3.hum1 |
| Red Hat hummingbird 1 | nodejs26-npm-bin | 0:26.4.0-1.3.hum1 |
| Red Hat hummingbird 1 | v8-13.6-devel | 0:13.6.233.17-1.24.18.0.0.2.hum1 |
| Red Hat hummingbird 1 | v8-14.6-devel | 0:14.6.202.34-1.26.4.0.1.3.hum1 |
| Ubuntu 24.04 LTS | nodejs | no fix |
| Ubuntu 25.10 | nodejs | no fix |
| Ubuntu 26.04 LTS | nodejs | no fix |
| Ubuntu 26.10 | nodejs | no fix |
| Ubuntu Pro 14.04 LTS | nodejs | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 18.04 LTS | nodejs | no fix |
| Ubuntu Pro 20.04 LTS | nodejs | no fix |
| Ubuntu Pro 22.04 LTS | nodejs | no fix |
| openSUSE Tumbleweed | nodejs26 | 26.3.1-1.1 |