CVE-2026-21636
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/01/2026
Last modified:
20/01/2026
Description
A flaw in Node.js&#39;s permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.<br />
<br />
* The issue affects users of the Node.js permission model on version v25.<br />
<br />
In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Impact
Base Score 3.x
5.80
Severity 3.x
MEDIUM