CVE-2026-48936 Security feature bypass in node
Attackers can bypass network permission restrictions to start local servers via Unix sockets in Node.js.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48936?
CVE-2026-48936 is a low-severity vulnerability in Nodejs Node.js, published on 26 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.
Weakness: CWE-284
Which versions are affected by CVE-2026-48936?
2 open source packages ship an affected version, including node and node-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 26.3.0 | 26.3.1 |
node-min Bitnami | From 26.3.0 | 26.3.1 |
Products include Nodejs Node.js.
How do I fix CVE-2026-48936?
Upgrade node to 26.3.1 or later.
Is CVE-2026-48936 being exploited?
There is no known exploitation of CVE-2026-48936 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as BIT-node-2026-48936, BIT-node-min-2026-48936, GHSA-hwhp-f859-r728, MINI-mpq4-f99r-p22w, UBUNTU-CVE-2026-48936.