Node.js: Four Permission Model & HTTPS Agent Flaws Patched in July 2026 Batch
Node.js patched four vulnerabilities on July 30-31, 2026, related to Permission Model enforcement and HTTPS Agent flaws, affecting versions 22.x through 26.x.
Key findings
- Four Node.js vulnerabilities disclosed July 30-31, 2026, impacting Permission Model and HTTPS Agent.
- Flaws in Permission Model enforcement allow unauthorized file writes and trace log creation.
- HTTPS Agent issues include TLS session reuse skipping hostname verification and mTLS client identity reuse.
- Vulnerabilities affect Node.js 22.x, 24.x, and 26.x, patched in v22.23.2, v24.18.1, and v26.5.1.
On July 30-31, 2026, Node.js addressed a batch of four vulnerabilities impacting its Permission Model enforcement and HTTPS Agent functionality. These disclosures, spanning across Node.js versions 22.x, 24.x, and 26.x, highlight potential risks to file system integrity and secure communication channels. The vulnerabilities were patched and released in Node.js versions v22.23.2, v24.18.1, and v26.5.1.
Two of the disclosed vulnerabilities, CVE-2026-58039 and CVE-2026-56847, stem from flaws in the Node.js Permission Model's enforcement. CVE-2026-58039 specifically allows process.report to write files outside of the paths permitted by the --allow-fs-write flag. Similarly, CVE-2026-56847 permits trace_events.createTracing().enable() to write trace logs beyond these allowed paths. Both issues can lead to the exposure of sensitive information or a bypass of intended security boundaries, depending on the configuration.
Further compounding the security concerns, CVE-2026-58040 addresses an incomplete fix for a vulnerability in the HTTPS Agent's TLS session reuse mechanism. This flaw allows hostname verification to be skipped across identity policies, potentially enabling man-in-the-middle attacks. This is a recurrence of a previously identified issue, CVE-2026-48934, indicating a persistent challenge in securing TLS session handling.
The fourth vulnerability, CVE-2026-56850, also relates to the HTTPS Agent, specifically a connection flaw that can lead to the reuse of mTLS client identities. This could allow an attacker to impersonate a legitimate client by reusing its established TLS session credentials.
These vulnerabilities were part of a larger security release by the Node.js project, which also included fixes for HTTP/2 processing, DNS resolution, SQLite handling, Zlib APIs, and the HTTP parser. The project also updated its bundled Undici and llhttp dependencies to mitigate further risks. Users are strongly advised to update to the patched versions to protect against potential data breaches and unauthorized access.
The timely disclosure and patching of these vulnerabilities underscore the importance of continuous security vigilance within the Node.js ecosystem. Developers relying on Node.js should prioritize updating their environments to the latest secure versions to safeguard their applications and data against these newly addressed threats. The Node.js project's commitment to addressing these issues promptly is crucial for maintaining the integrity and security of the widely used JavaScript runtime.