CVE-2026-21636 is a medium-severity vulnerability in Node.js v25.2.1 affecting the permission model. When the --permission flag is enabled, the flaw allows connections to Unix Domain Sockets to bypass network restrictions, even if --allow-net is not granted. Attackers can use inputs such as URLs or socketPath options in net, tls, or undici/fetch modules to connect to arbitrary local sockets. This breaks the security boundary intended by the permission model and may enable access to privileged local services, leading to privilege escalation or data exposure. The network permission system was experimental during this version.

The vulnerability allows unauthorized local socket connections bypassing network permission restrictions, potentially exposing privileged local services. This can lead to privilege escalation or data exposure on affected systems. There are no known exploits in the wild at the time of publication. The CVSS 3.0 base score is 5.8 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and limited confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated, users should monitor the Node.js project for updates addressing this vulnerability. Until a fix is available, avoid enabling the --permission flag in environments where untrusted inputs can influence socket connections or restrict usage of affected Node.js version 25.2.1.