CVE-2026-21711
published 2026-03-30CVE-2026-21711: A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all…
PriorityP428medium5.3CVSS 3.0
AVLACLPRLUINSUCLILAL
EPSS
0.18%
7.1th percentile
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.* | 18.* |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | 25.8.1 – 25.8.1 | — |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | < 20.0.0 | 20.0.0 |
| nodejs | node.js | 25.0.0 – 25.8.1 | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
osv5.3MEDIUM
vendor_debian5.3LOW
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vcqx-cqfc-xc2r: A flaw in Node
ghsa_unreviewed·2026-03-30
CVE-2026-21711 [MEDIUM] CWE-284 GHSA-vcqx-cqfc-xc2r: A flaw in Node
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
OSV
CVE-2026-21711: A flaw in Node
osv·2026-03-30·CVSS 5.3
CVE-2026-21711 [MEDIUM] CVE-2026-21711: A flaw in Node
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Red Hat
Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks
vendor_redhat·2026-03-30·CVSS 5.3
CVE-2026-21711 [MEDIUM] CWE-940 Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks
Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
A flaw was found in Node.js. The Node.js
Debian
CVE-2026-21711: nodejs - A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket...
vendor_debian·2026·CVSS 5.3
CVE-2026-21711 [MEDIUM] CVE-2026-21711: nodejs - A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket...
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-21711 Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks
bugzilla·2026-03-30·CVSS 5.3
CVE-2026-21711 [MEDIUM] CVE-2026-21711 Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks
CVE-2026-21711 Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Discussion:
This issue
Wiz
CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-21711 [MEDIUM] CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21711 :
Node.js vulnerability analysis and mitigation
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
--permission
--allow-net
--allow-net
--allow-net
Source : NVD
## 5.3
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-25
cpe:2.3:a:nodejs:node.js
Sources
NVD
MinimOS Severity MEDIUM Has Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix
2026-03-30
Published