VULNERABILITY INTELLIGENCE

CVE-2026-21711

CVSS score5.3 MEDIUM
EPSS probability0.17%
CISA KEVNot currently listed
Published2026-03-30
Last modified2026-08-19
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Primary references