{
  "threat_severity" : "Low",
  "public_date" : "2026-07-30T06:02:50Z",
  "bugzilla" : {
    "description" : "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions",
    "id" : "2509178",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2509178"
  },
  "cvss3" : {
    "cvss3_base_score" : "3.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-284",
  "details" : [ "A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.", "A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure." ],
  "statement" : "This Low impact flaw in Node.js allows a local attacker to bypass filesystem write restrictions for trace logs when using `trace_events.createTracing().enable()`. This limited integrity impact permits specific log files to be written outside the intended `--allow-fs-write` boundary.",
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48273",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs26-main-26.5.1-1.5.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48305",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs22-main-22.23.2-2.3.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-30T00:00:00Z",
    "advisory" : "RHSA-2026:48537",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nodejs24-main-24.18.1-0.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs22",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs24",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs:22/nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs:24/nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs:22/nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs:24/nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "nodejs:26/nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "nodejs20",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "nodejs25",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-56847\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56847\nhttps://nodejs.org/en/blog/vulnerability/july-2026-security-releases" ],
  "name" : "CVE-2026-56847",
  "mitigation" : {
    "value" : "Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows.",
    "lang" : "en:us"
  },
  "csaw" : false
}