Node.js contains a flaw in its Permission Model network enforcement where Unix Domain Socket (UDS) server operations do not enforce permission checks as strictly as other network paths. Specifically, when running Node.js processes with the `--permission` flag but without the `--allow-net` flag, local IPC endpoints can be created and exposed via UDS, allowing communication with other local processes outside the intended network restriction boundary. This affects Node.js versions 3.0 and all 25.x versions from 25.0.0 up to but excluding 25.8.2. The vulnerability is tracked as CVE-2026-21711 and is classified under CWE-284 (Improper Access Control). A patch is available to fix this issue.

The vulnerability allows processes running Node.js with restricted network permissions (omitting `--allow-net`) to bypass these restrictions by creating Unix Domain Socket servers that communicate locally. This could lead to unintended inter-process communication on the same host, potentially violating security boundaries intended by the permission model. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should upgrade Node.js to version 25.8.2 or later where the issue is fixed. Until patched, avoid relying solely on the `--permission` flag without `--allow-net` to restrict network access, as the current implementation does not enforce permissions correctly for UDS server operations.