A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. (CVE-2026-21636)
A critical flaw in Node.js version 25's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when the --permission flag is enabled. This vulnerability permits attacker-controlled inputs to connect to arbitrary local sockets even without the --allow-net permission, breaking the intended security boundary. This can lead to privilege escalation, data exposure, or local code execution. The issue affects Node.js versions from 25.0.0 up to but not including 25.3.0. A patch is available for this vulnerability.
AI Analysis
Technical Summary
CVE-2026-21636 is a critical vulnerability in Node.js's permission model affecting versions >=25.0.0 <25.3.0. When the --permission flag is enabled, Unix Domain Socket connections can bypass network restrictions intended by the permission model. Specifically, even without the --allow-net permission, attacker-controlled inputs such as URLs or socketPath options can connect to arbitrary local sockets via net, tls, or undici/fetch modules. This breaks the security boundary designed to restrict network access and may allow attackers to access privileged local services, potentially resulting in privilege escalation, data exposure, or local code execution. The network permissions feature was still experimental at the time of this vulnerability. A patch is available to address this issue.
Potential Impact
The vulnerability allows bypassing of network restrictions in Node.js's permission model, enabling unauthorized connections to local Unix Domain Sockets. This can lead to unauthorized access to privileged local services, which may result in privilege escalation, exposure of sensitive data, or execution of arbitrary code locally.
Mitigation Recommendations
A patch is available for this vulnerability. Users of Node.js versions >=25.0.0 <25.3.0 should upgrade to a fixed version as soon as possible to remediate this issue. No additional mitigation steps are indicated beyond applying the official fix.
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. (CVE-2026-21636)
Description
A critical flaw in Node.js version 25's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when the --permission flag is enabled. This vulnerability permits attacker-controlled inputs to connect to arbitrary local sockets even without the --allow-net permission, breaking the intended security boundary. This can lead to privilege escalation, data exposure, or local code execution. The issue affects Node.js versions from 25.0.0 up to but not including 25.3.0. A patch is available for this vulnerability.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-21636 is a critical vulnerability in Node.js's permission model affecting versions >=25.0.0 <25.3.0. When the --permission flag is enabled, Unix Domain Socket connections can bypass network restrictions intended by the permission model. Specifically, even without the --allow-net permission, attacker-controlled inputs such as URLs or socketPath options can connect to arbitrary local sockets via net, tls, or undici/fetch modules. This breaks the security boundary designed to restrict network access and may allow attackers to access privileged local services, potentially resulting in privilege escalation, data exposure, or local code execution. The network permissions feature was still experimental at the time of this vulnerability. A patch is available to address this issue.
Potential Impact
The vulnerability allows bypassing of network restrictions in Node.js's permission model, enabling unauthorized connections to local Unix Domain Sockets. This can lead to unauthorized access to privileged local services, which may result in privilege escalation, exposure of sensitive data, or execution of arbitrary code locally.
Mitigation Recommendations
A patch is available for this vulnerability. Users of Node.js versions >=25.0.0 <25.3.0 should upgrade to a fixed version as soon as possible to remediate this issue. No additional mitigation steps are indicated beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2026-21636
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-21636"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
Threat ID: 6aa005faacd9273b49ab68a1
Added to database: 09/08/2026, 12:56:26 UTC
Last enriched: 09/08/2026, 13:36:25 UTC
Last updated: 09/10/2026, 19:36:52 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.