CVE-2026-21636: Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.
In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.
Other sources
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.
The issue affects users of the Node.js permission model on version v25.
In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.3.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-21636?
CVE-2026-21636 is considered a high severity vulnerability due to its potential to enable unauthorized access to local sockets.
How do I fix CVE-2026-21636?
To mitigate CVE-2026-21636, avoid using the `--permission` flag and validate all inputs to ensure they do not include unauthorized socket paths.
Who is affected by CVE-2026-21636?
CVE-2026-21636 affects applications using Node.js versions where the permission model allows Unix Domain Socket connections to bypass network restrictions.
What impact does CVE-2026-21636 have on system security?
The impact of CVE-2026-21636 could lead to unauthorized data access or manipulation by allowing an attacker to connect to sensitive local sockets.
Is CVE-2026-21636 present in all Node.js versions?
CVE-2026-21636 is not present in all Node.js versions; it specifically affects versions where the flawed permission model is implemented.