CVE-2026-48936: Node.js

Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days.

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

Affected products

• Node.js Node.js: version 26.3.0 only

Published 2026-06-26. Last modified 2026-06-26.