This vulnerability involves a missing permission check in Node.js's handling of Unix Domain Socket server operations under the '--permission' flag. While other network paths enforce permission checks correctly, UDS server operations do not, potentially allowing unauthorized access or actions by code that should be restricted. The issue is tracked as CVE-2026-21711 and is associated with CWE-284 (Improper Access Control). Affected products include Microsoft Azure Linux and Node.js 24. There is no available CVSS score or patch information at this time.

The impact is improper access control for Unix Domain Socket server operations in Node.js, which could lead to unauthorized code execution or access within affected environments. Since permission checks are bypassed, this may allow code running with restricted permissions to perform operations it should not be allowed to. No known exploits have been reported, and the exact impact depends on the deployment context and usage of UDS in Node.js applications.

Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of Node.js applications using Unix Domain Sockets and review permission configurations. No vendor advisory or patch links are currently provided, so monitor official channels for updates.