CVE-2026-56850

CVE-2026-56850 affects Node.js 22.x, 24.x, and 26.x. The issue is in the HTTPS Agent’s connection reuse, where PFX object-array key collisions can cause mutual TLS (mTLS) client identities to be reused across requests with different client certificates. This could enable cross-certificate identit...

CVE-2026-56847

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() to write trace logs outside the --allow-fs-write boundary, leading to confidentiality impact or bypass of the intended security boundary under affected configurations. The vulnerability affects Node.js 22....

CVE-2026-48617

A path-validation flaw in Node.js Permission Model enforcement allows process.report.writeReport() to bypass intended filesystem restrictions, leading to confidentiality impact. NVD rates it HIGH (CVSS 8.2, network, no auth). CISA SSVC confirms no active exploitation. Affected: Node.js 22, 24, 26...

CVE-2026-58043

CVE-2026-58043 is a vulnerability in Node.js Permission Model enforcement that can over-grant filesystem access across radix-tree prefix boundaries when using --permission. An attacker granted access to one path could read from or write to paths outside the intended allowlist. Affected releases i...