CVE-2026-21636: Critical severity npm/node vulnerability
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.
The issue affects users of the Node.js permission model on version v25.
In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not enable the experimental permission model (--permission) on Node.js v25. Run without --permission until an official fix is released to prevent Unix Domain Socket (UDS) connections from bypassing network restrictions.
Node.js --permission = disabled - Configuration
Validate, sanitize, or disallow attacker-controlled inputs (such as URLs or socketPath options) before passing them to net, tls, or undici/fetch to prevent connections to arbitrary local sockets.
application code (net/tls/undici/fetch) handling of attacker-controlled URLs/socketPath = validate or disallow - Compensating control
Restrict access to privileged local Unix domain sockets and local services (for example via filesystem permissions, process isolation, or limiting which local services are exposed) so untrusted code cannot reach sensitive local sockets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21636?
CVE-2026-21636 is considered a high severity vulnerability due to its potential to enable unauthorized access to local sockets.
How do I fix CVE-2026-21636?
To mitigate CVE-2026-21636, avoid using the `--permission` flag and validate all inputs to ensure they do not include unauthorized socket paths.
Who is affected by CVE-2026-21636?
CVE-2026-21636 affects applications using Node.js versions where the permission model allows Unix Domain Socket connections to bypass network restrictions.
What impact does CVE-2026-21636 have on system security?
The impact of CVE-2026-21636 could lead to unauthorized data access or manipulation by allowing an attacker to connect to sensitive local sockets.
Is CVE-2026-21636 present in all Node.js versions?
CVE-2026-21636 is not present in all Node.js versions; it specifically affects versions where the flawed permission model is implemented.