Security Flaw in Node.js Permission Model Allows Unauthorized Socket Connections

CVE-2026-21636

What is CVE-2026-21636?

A critical security flaw in Node.js's permission model permits unauthorized Unix Domain Socket (UDS) connections, enabling attackers to bypass intended network restrictions when --permission is enabled. Even if the --allow-net option is not utilized, malicious inputs can facilitate connections to arbitrary local sockets through net, tls, or undici/fetch modules. This vulnerability undermines the security framework and may allow unauthorized access to sensitive local services, which can result in privilege escalation, data exposure, or the execution of arbitrary code on the local machine.

References