Vulnerability in Node.js Affects Unix Domain Socket Operations

CVE-2026-21711

What is CVE-2026-21711?

A vulnerability in the Node.js Permission Model undermines proper network enforcement for Unix Domain Socket (UDS) server operations. This flaw allows processes running without explicit network permissions to expose local IPC endpoints, facilitating unintended communication with other processes on the same host. When --permission is active, the absence of --allow-net—which is designed to restrict network access—fails to enforce needed permission checks, thus breaching the intended security boundary. This exposes a potential risk for applications relying on Node.js 25.x that utilize the Permission Model.

References