UBUNTU-CVE-2026-56847

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-56847

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-56847

Upstream

CVE-2026-56847

Published

2026-07-31T00:00:00Z

Modified

2026-07-31T14:38:03.719699400Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26.x.

References

Affected packages

Ubuntu:24.04:LTS

nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

18.*

18.13.0+dfsg1-1ubuntu2

18.19.1+dfsg-2ubuntu4

18.19.1+dfsg-6ubuntu1

18.19.1+dfsg-6ubuntu2

18.19.1+dfsg-6ubuntu5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libnode109",
            "binary_version": "18.19.1+dfsg-6ubuntu5"
        },
        {
            "binary_name": "nodejs",
            "binary_version": "18.19.1+dfsg-6ubuntu5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json"

Ubuntu:26.04:LTS

nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

20.*

20.19.4+dfsg-1

20.19.5+dfsg+~cs20.19.12-4

22.*

22.21.1+dfsg+~cs22.19.0-6ubuntu4

22.22.0+dfsg+~cs22.19.6-1ubuntu2

22.22.0+dfsg+~cs22.19.13-2ubuntu1

22.22.1+dfsg+~cs22.19.15-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libnode127",
            "binary_version": "22.22.1+dfsg+~cs22.19.15-1ubuntu1"
        },
        {
            "binary_name": "nodejs",
            "binary_version": "22.22.1+dfsg+~cs22.19.15-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json"

Ubuntu:Pro:14.04:LTS

nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.15~dfsg1-4

0.10.21~dfsg1-1

0.10.22~dfsg1-2

0.10.23~dfsg1-1

0.10.23~dfsg1-2

0.10.23~dfsg1-3

0.10.24~dfsg1-1

0.10.25~dfsg2-2

0.10.25~dfsg2-2ubuntu1

0.10.25~dfsg2-2ubuntu1.2

0.10.25~dfsg2-2ubuntu1.2+esm1

0.10.25~dfsg2-2ubuntu1.2+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "nodejs",
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2"
        },
        {
            "binary_name": "nodejs-legacy",
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json"

Ubuntu:Pro:16.04:LTS

nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.25~dfsg2-2ubuntu1

4.*

4.2.2~dfsg-1

4.2.3~dfsg-1

4.2.4~dfsg-1ubuntu1

4.2.4~dfsg-2

4.2.6~dfsg-1ubuntu1

4.2.6~dfsg-1ubuntu4

4.2.6~dfsg-1ubuntu4.1

4.2.6~dfsg-1ubuntu4.2

4.2.6~dfsg-1ubuntu4.2+esm1

4.2.6~dfsg-1ubuntu4.2+esm2

4.2.6~dfsg-1ubuntu4.2+esm3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "nodejs",
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3"
        },
        {
            "binary_name": "nodejs-legacy",
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json"

Ubuntu:Pro:18.04:LTS

nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.11.4~dfsg-1ubuntu1

6.11.4~dfsg-1ubuntu2

6.12.0~dfsg-1ubuntu1

6.12.0~dfsg-2ubuntu1

6.12.0~dfsg-2ubuntu2

8.*

8.10.0~dfsg-2

8.10.0~dfsg-2ubuntu0.2

8.10.0~dfsg-2ubuntu0.3

8.10.0~dfsg-2ubuntu0.4

8.10.0~dfsg-2ubuntu0.4+esm1

8.10.0~dfsg-2ubuntu0.4+esm2

8.10.0~dfsg-2ubuntu0.4+esm3

8.10.0~dfsg-2ubuntu0.4+esm4

8.10.0~dfsg-2ubuntu0.4+esm5

8.10.0~dfsg-2ubuntu0.4+esm6

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "nodejs",
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm6"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json"

Ubuntu:Pro:20.04:LTS

nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

10.*

10.15.2~dfsg-2ubuntu1

10.17.0~dfsg-2ubuntu4

10.17.0~dfsg-2ubuntu6

10.19.0~dfsg-3ubuntu1

10.19.0~dfsg-3ubuntu1.1

10.19.0~dfsg-3ubuntu1.2

10.19.0~dfsg-3ubuntu1.3

10.19.0~dfsg-3ubuntu1.5

10.19.0~dfsg-3ubuntu1.6

10.19.0~dfsg-3ubuntu1.6+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libnode64",
            "binary_version": "10.19.0~dfsg-3ubuntu1.6+esm2"
        },
        {
            "binary_name": "nodejs",
            "binary_version": "10.19.0~dfsg-3ubuntu1.6+esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json"

Ubuntu:Pro:22.04:LTS

nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

12.*

12.22.5~dfsg-5ubuntu1

12.22.7~dfsg-2ubuntu1

12.22.7~dfsg-2ubuntu3

12.22.9~dfsg-1ubuntu2

12.22.9~dfsg-1ubuntu3

12.22.9~dfsg-1ubuntu3.1

12.22.9~dfsg-1ubuntu3.2

12.22.9~dfsg-1ubuntu3.3

12.22.9~dfsg-1ubuntu3.4

12.22.9~dfsg-1ubuntu3.5

12.22.9~dfsg-1ubuntu3.6

12.22.9~dfsg-1ubuntu3.6+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libnode72",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
        },
        {
            "binary_name": "nodejs",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56847.json"