CVE-2026-56847: 
Node.js Analyse et atténuation des vulnérabilités

CVE-2026-56847 is a security feature bypass vulnerability in the Node.js Permission Model that allows trace_events.createTracing().enable() to write trace logs to filesystem locations outside the paths permitted by the --allow-fs-write flag. Disclosed on July 30, 2026, as part of Node.js's July 2026 security release batch, it affects Node.js versions 22.x (up to and including 22.23.1), 24.x (up to and including 24.18.0), and 26.x (up to and including 26.5.0). The vulnerability was reported by researcher 0xoroot and fixed by RafaelGSS. It carries a CVSS v3.0 base score of 3.3 (Low), assigned by HackerOne (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-1119 (Excessive Use of Unconditional Branching), reflecting a flaw in the enforcement logic of Node.js's experimental Permission Model. When trace_events.createTracing().enable() is invoked, the trace log output path is not validated against the --allow-fs-write allowlist, allowing writes to bypass the intended filesystem access control boundary. Exploitation requires local access and low privileges — an attacker or untrusted script running within a Node.js process that uses the Permission Model can leverage the trace_events module to write files to otherwise restricted paths. No public proof-of-concept code has been identified (Node.js Advisory, GitHub Advisory).

Successful exploitation allows a low-privileged local user to write trace log files to filesystem locations that should be protected by the --allow-fs-write permission model, bypassing the intended security boundary. The primary impact is an integrity violation — unauthorized file writes to restricted paths — with a secondary potential confidentiality impact if sensitive file locations can be overwritten or if trace log content exposes sensitive runtime data. Availability is not affected, and the scope of impact is limited to the local system running the affected Node.js process (Node.js Advisory, GitHub Advisory).

1. Precondition: Gain local access (low-privilege) to a system running a Node.js application (22.x, 24.x, or 26.x) that uses the experimental Permission Model with --allow-fs-write restrictions configured.
2. Identify restricted paths: Determine which filesystem paths are blocked by the --allow-fs-write allowlist in the target Node.js process configuration.
3. Invoke trace_events: Within the Node.js process context, call require('trace_events').createTracing({ categories: ['node'] }).enable() to activate tracing.
4. Trigger write outside allowlist: Configure or observe that the trace log output is directed to a path outside the --allow-fs-write allowlist — the Permission Model enforcement does not intercept this write.
5. Achieve objective: Files are written to the restricted path, bypassing the intended security boundary, potentially overwriting sensitive files or planting data in protected locations (Node.js Advisory).

• File System: Unexpected trace log files (e.g., node_trace.*.log) appearing in directories not included in the --allow-fs-write allowlist; file modification timestamps on sensitive files coinciding with Node.js process activity.
• Logs: Node.js process logs showing trace_events module activation; audit logs recording file write events to restricted paths originating from a Node.js process PID.
• Process: Node.js processes launched with --permission and --allow-fs-write flags that also invoke trace_events.createTracing().enable() in their execution flow.

Node.js has released patched versions addressing this vulnerability: v22.23.2, v24.18.1, and v26.5.1. Upgrading to one of these versions is the recommended remediation. As a temporary workaround, restrict or prohibit use of the trace_events module in untrusted code running under the Permission Model, and review --allow-fs-write configurations to understand exposure. The Node.js Permission Model is experimental, and operators should evaluate whether enabling it is appropriate for their threat model (Node.js Advisory, GitHub Advisory).

CVE-2026-56847 was disclosed as part of a broader July 2026 Node.js security release addressing 11 vulnerabilities, with the highest-severity issues rated High. Security news outlets including CyberSecurityNews and The Daily Tech Feed covered the release batch, noting the breadth of fixes across HTTP/2, Permission Model, SQLite, DNS, and zlib components. Community attention was primarily focused on the High-severity issues (CVE-2026-56846, CVE-2026-56848, CVE-2026-58043) rather than this Low-severity finding (CyberSecurityNews, Node.js Advisory).