DEBIAN-CVE-2026-48617
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-48617
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48617.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-48617
- Upstream
- Published
- 2026-06-18T17:16:31Z
- Modified
- 2026-08-27T23:06:07Z
- Severity
-
- 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw in Node.js Permission Model enforcement allows Bypass via
process.report.writeReport()Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. - References
Affected packages
Debian:13 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:deb/debian/nodejs?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
20.*
20.19.2+dfsg-1
20.19.2+dfsg-1+deb13u1
20.19.2+dfsg-1+deb13u2
20.19.4+dfsg-1
20.19.5+dfsg+~cs20.19.12-1
20.19.5+dfsg+~cs20.19.12-2
20.19.5+dfsg+~cs20.19.12-3
20.19.5+dfsg+~cs20.19.12-4
20.19.5+dfsg+~cs20.19.24-1
22.*
22.12.0+dfsg-1
22.12.0+dfsg-2
22.12.0+dfsg-3
22.14.0+dfsg-1
22.18.0+dfsg-1
22.18.0+dfsg+~cs22.17.2-1
22.18.0+dfsg+~cs22.17.2-2
22.19.0+dfsg+~cs22.18.0-1
22.21.1+dfsg+~cs22.19.0-1
22.21.1+dfsg+~cs22.19.0-2
22.21.1+dfsg+~cs22.19.0-3
22.21.1+dfsg+~cs22.19.0-4
22.21.1+dfsg+~cs22.19.0-5
22.21.1+dfsg+~cs22.19.0-6
22.22.0+dfsg+~cs22.19.6-1
22.22.0+dfsg+~cs22.19.13-1
22.22.0+dfsg+~cs22.19.13-2
22.22.1+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-3
24.*
24.11.1+dfsg+~cs24.10.1-1
24.11.1+dfsg+~cs24.10.1-2
24.12.0+dfsg+~cs24.10.4-1
24.13.0+dfsg+~cs24.10.7-1
24.13.0+dfsg+~cs24.10.7-2
24.14.0+dfsg+~cs24.12.0-1
24.14.0+dfsg+~cs24.12.0-2
24.14.1+dfsg+~cs24.12.0-1
24.15.0+dfsg+~cs24.12.2-1
24.16.0+dfsg+~cs24.13.1-1
24.16.0+dfsg+~cs24.13.1-2
24.17.0+dfsg+~cs24.13.2-1
24.18.0+dfsg+~cs24.13.2-1
24.19.0+dfsg+~cs24.13.3-1
Debian:14 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:deb/debian/nodejs?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed24.17.0+dfsg+~cs24.13.2-1
Affected versions
20.*
20.19.2+dfsg-1
20.19.4+dfsg-1
20.19.5+dfsg+~cs20.19.12-1
20.19.5+dfsg+~cs20.19.12-2
20.19.5+dfsg+~cs20.19.12-3
20.19.5+dfsg+~cs20.19.12-4
20.19.5+dfsg+~cs20.19.24-1
22.*
22.12.0+dfsg-1
22.12.0+dfsg-2
22.12.0+dfsg-3
22.14.0+dfsg-1
22.18.0+dfsg-1
22.18.0+dfsg+~cs22.17.2-1
22.18.0+dfsg+~cs22.17.2-2
22.19.0+dfsg+~cs22.18.0-1
22.21.1+dfsg+~cs22.19.0-1
22.21.1+dfsg+~cs22.19.0-2
22.21.1+dfsg+~cs22.19.0-3
22.21.1+dfsg+~cs22.19.0-4
22.21.1+dfsg+~cs22.19.0-5
22.21.1+dfsg+~cs22.19.0-6
22.22.0+dfsg+~cs22.19.6-1
22.22.0+dfsg+~cs22.19.13-1
22.22.0+dfsg+~cs22.19.13-2
22.22.1+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-1
22.22.2+dfsg+~cs22.19.15-3
24.*
24.11.1+dfsg+~cs24.10.1-1
24.11.1+dfsg+~cs24.10.1-2
24.12.0+dfsg+~cs24.10.4-1
24.13.0+dfsg+~cs24.10.7-1
24.13.0+dfsg+~cs24.10.7-2
24.14.0+dfsg+~cs24.12.0-1
24.14.0+dfsg+~cs24.12.0-2
24.14.1+dfsg+~cs24.12.0-1
24.15.0+dfsg+~cs24.12.2-1
24.16.0+dfsg+~cs24.13.1-1
24.16.0+dfsg+~cs24.13.1-2