UpHeron
All vulnerabilities

Servers and applications

CVE-2026-21636

Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)

Severity
Critical 10.0
Published
13 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
25.3.0
Sources
NVD, nodejs

Description

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 25.0.0 before 25.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-21636
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-21636
  • Node.js security release https://nodejs.org/en/blog/vulnerability/december-2025-security-releases