CVE-2026-56847

score

0.1

cvss

6.1

epss

0.2%

published

2026-07-30

kev added

—

first seen

2026-10-21

Node.js 22.x, 24.x, and 26.x contain a broken access control vulnerability caused by trace_events.createTracing().enable() writing trace logs outside the --allow-fs-write boundary, letting attackers bypass intended security restrictions, exploit requires specific configuration allowing trace log writes.