CVE-2026-21711: Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
Note that --allow-net is currently an experimental feature.
Other sources
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.8.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-21711?
CVE-2026-21711 is classified as a medium severity vulnerability.
How do I fix CVE-2026-21711?
To mitigate CVE-2026-21711, ensure that the Node.js server runs with appropriate permissions including the `--allow-net` flag.
What impact does CVE-2026-21711 have on my Node.js application?
CVE-2026-21711 can allow unauthorized access to Unix Domain Socket operations if proper permission checks are not enforced.
Which versions of Node.js are affected by CVE-2026-21711?
CVE-2026-21711 affects Node.js versions between 25.0.0 and 26.0.0.
Is CVE-2026-21711 a zero-day vulnerability?
CVE-2026-21711 is not classified as a zero-day vulnerability since it has been publicly disclosed and a patch is available.