CVE-2026-56847
Awaiting Analysis Awaiting Analysis - Queue

Trace Event Log Write Bypass in Node.js

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: HackerOne

Description
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-56847
EUVD
EUVD-2026-51022

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
nodejs node.js From 22.x (inc)
nodejs node.js From 24.x (inc)
nodejs node.js From 26.x (inc)
nodejs node.js 22.x
nodejs node.js 24.x
nodejs node.js 26.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1119 The code uses too many unconditional branches (such as "goto").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56847 is a flaw in Node.js's Permission Model enforcement. It allows the trace_events.createTracing().enable() function to write trace logs outside the paths permitted by the --allow-fs-write flag. This could lead to unauthorized data access or bypass of security boundaries.

Detection Guidance

To detect this vulnerability, check if Node.js applications using the Permission Model are running with `--allow-fs-write` restrictions. Inspect logs for unexpected trace log writes outside permitted paths. Verify Node.js versions 22.x, 24.x, or 26.x are updated to patched releases.

Impact Analysis

If exploited, this vulnerability could allow an attacker to write trace logs to unintended locations, potentially leaking sensitive data or bypassing filesystem write restrictions. This affects users relying on the Permission Model in Node.js versions 22.x, 24.x, and 26.x.

Compliance Impact

This vulnerability could lead to confidentiality impact by allowing unauthorized writing of trace logs outside intended boundaries. This may violate data protection requirements under GDPR or HIPAA if sensitive data is exposed or improperly accessed.

Mitigation Strategies

Update Node.js to the latest patched version in the 22.x, 24.x, or 26.x release lines to address the flaw in Permission Model enforcement.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart