Loading vulnerability…
Node.js Permission Model Bypass Through Trace-Event Logging
CVE-2026-56847 is an authorization enforcement flaw in the Node.js Permission Model affecting release branches 22.x, 24.x, and 26.x. Calling trace_events.createTracing().enable() can cause trace logs to be written outside locations authorized by --allow-fs-write. This bypasses the intended filesystem-write security boundary and can affect confidentiality under affected configurations.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized trace-log writes outside the configured filesystem write allowlist, compromising the integrity of that restriction and potentially exposing information recorded in trace logs. The vulnerability is rated Medium with a CVSS v3.0 score of 6.1, reflecting high confidentiality impact, low integrity impact, and no availability impact. Arbitrary code execution or unrestricted filesystem reads are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Apply a fixed runtime or vendor package rather than relying on --allow-fs-write to prevent trace-log writes outside the allowlist.
Patch, then assume compromise.
Upgrade Node.js to version 22.23.2, 24.18.1, or 26.5.1, or a later security-supported release in the corresponding branch. For distribution-managed installations, apply the vendor's security-fixed packages: Chainguard nodejs-22 22.23.2-r0 or later, Alpine nodejs-current 26.5.1-r0 or later, or Debian 13 nodejs 20.19.2+dfsg-1+deb13u3 or later, as applicable. Update bundled Node.js runtimes through the corresponding product or buildpack security release.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.