← Database

CVE-2026-48936

LOW CVSS: 3.3 Published: 2026-06-26 Modified: 2026-06-26

Description

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

Affected Platforms

Nodejs Node.Js

Weakness Type

CWE-284

References