CVE-2026-21711 — Improper Access Control in Node

CWE-284 — Improper Access ControlCWE-940 — Improper Verification of Source of a Communication Channel8 documents8 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 99.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nodejs Node
Timeline
PublishedMar 30

Description

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Per…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.8 | Impact: 3.4

Affected Packages1 packages

▶CVEListV5nodejs/node4.0 — 4.*+16

🔴Vulnerability Details

3
GHSA
GHSA-vcqx-cqfc-xc2r: A flaw in Node↗2026-03-30
▶
OSV
CVE-2026-21711: A flaw in Node↗2026-03-30
▶
CVEList
CVE-2026-21711: A flaw in Node↗2026-03-30
▶

📋Vendor Advisories

2
Red Hat
Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks↗2026-03-30
▶
Debian
CVE-2026-21711: nodejs - A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2026-21711 Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks↗2026-03-30
▶
CVE-2026-21711 — Improper Access Control in Nodejs Node | cvebase