5.8
Moyenne
CVE-2026-21636 A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when…
Description
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Node | 25.2.1 | Pas de correctif indiqué |
Références
- nodejs.org nodejs.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Node
Les 129 CVE de Node →
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
Élevée
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Moyenne
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Faible
CVE-2026-106070
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
3.7
Faible