CVE-2026-21711: Medium severity Node.js Node.js vulnerability
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Node.js 25.x Permission Model deployments, avoid running with `--permission` while omitting `--allow-net` if local IPC/UDS endpoint creation is not intended; ensure `--allow-net` is configured to match the required network access policy (note: `--allow-net` is described as experimental).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21711?
CVE-2026-21711 is classified as a medium severity vulnerability.
How do I fix CVE-2026-21711?
To mitigate CVE-2026-21711, ensure that the Node.js server runs with appropriate permissions including the `--allow-net` flag.
What impact does CVE-2026-21711 have on my Node.js application?
CVE-2026-21711 can allow unauthorized access to Unix Domain Socket operations if proper permission checks are not enforced.
Which versions of Node.js are affected by CVE-2026-21711?
CVE-2026-21711 affects Node.js versions between 25.0.0 and 26.0.0.
Is CVE-2026-21711 a zero-day vulnerability?
CVE-2026-21711 is not classified as a zero-day vulnerability since it has been publicly disclosed and a patch is available.