Security Flaw in Node.js Permission Model Allows Unauthorized Socket Connections

CVE-2026-21636

What is CVE-2026-21636?

A critical security flaw in Node.js's permission model permits unauthorized Unix Domain Socket (UDS) connections, enabling attackers to bypass intended network restrictions when --permission is enabled. Even if the --allow-net option is not utilized, malicious inputs can facilitate connections to arbitrary local sockets through net, tls, or undici/fetch modules. This vulnerability undermines the security framework and may allow unauthorized access to sensitive local services, which can result in privilege escalation, data exposure, or the execution of arbitrary code on the local machine.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References