CVE-2026-48935

score

<0.1

cvss

3.3

epss

0.2%

published

2026-06-26

kev added

—

first seen

2026-10-21

Node.js 22, 24, and 26 contain a broken access control vulnerability caused by improper enforcement of read-only file path permissions in the Permission API, letting attackers modify file metadata, exploit requires file system access with read-only flag.