Description (CNA)
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| nodejs / node | affected 22.22.3 through 22.22.3; affected 24.16.0 through 24.16.0; affected 26.3.0 through 26.3.0 |
CWE
CWE-284
References
- https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
- http://hackerone.com/reports/3692858
ADP enrichment
No English description supplied.
No references supplied.