CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21636?
CVE-2026-21636 is considered a high severity vulnerability due to its potential to enable unauthorized access to local sockets.
How do I fix CVE-2026-21636?
To mitigate CVE-2026-21636, avoid using the `--permission` flag and validate all inputs to ensure they do not include unauthorized socket paths.
Who is affected by CVE-2026-21636?
CVE-2026-21636 affects applications using Node.js versions where the permission model allows Unix Domain Socket connections to bypass network restrictions.
What impact does CVE-2026-21636 have on system security?
The impact of CVE-2026-21636 could lead to unauthorized data access or manipulation by allowing an attacker to connect to sensitive local sockets.
Is CVE-2026-21636 present in all Node.js versions?
CVE-2026-21636 is not present in all Node.js versions; it specifically affects versions where the flawed permission model is implemented.