Node.js Permission API flaw spawns local server via Unix socket
CVE-2026-48936 Published on June 26, 2026

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

NVD

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2026-48936 has been classified to as an Authorization vulnerability or weakness.


Affected Versions

nodejs node: