Every CVE Search/ Get API key

CVE-2026-21636

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass...

5.8 MediumPublic exploitFix available

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.87%Up 0.9 points since Jan 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.8

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
CVE-2026-21636
CVSS 3.0
5.8 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2026-3334 5.8

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
EUVD-2026-3334
CVSS 3.0
5.8 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-7xhv-hcmf-4rfv 5.8

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass...

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
GHSA-7xhv-hcmf-4rfv
CVSS 3.0
5.8 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
NVD 10.0

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
CVE-2026-21636
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0
5.8 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVBELL-CVE-2026-21636 10.0

CVE-2026-21636 does not affect BellSoft software

Record
BELL-CVE-2026-21636
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSV 5.8

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
CVE-2026-21636
CVSS 3.0
5.8 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVRHSA-2026:6402 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:6402
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:6431 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:6431
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7386 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7386
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7387 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-21636 10.0

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
UBUNTU-CVE-2026-21636
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0
5.8 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-04
OSVBIT-node-2026-21636 No score

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
BIT-node-2026-21636
Updated
2026-11-02
OSVBIT-node-min-2026-21636 No score

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

Record
BIT-node-min-2026-21636
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
node
Bitnami
 25.0.0 up to 25.3.0
25.3.0
node-min
Bitnami
 25.0.0 up to 25.3.0
25.3.0
nodejs24
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.14.1-4.hum1
0:24.14.1-4.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.14.1-4.hum1
0:24.14.1-4.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.14.1-4.hum1
0:24.14.1-4.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.14.1-4.hum1
0:24.14.1-4.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.14.1-4.hum1
0:24.14.1-4.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.14.1-4.hum1
0:24.14.1-4.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.11.0-1.24.14.1.4.hum1
0:11.11.0-1.24.14.1.4.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:24.14.1-4.hum1
0:24.14.1-4.hum1
Show 26 moreShow less
Affected packages
PackageAffectedFixed
nodejs25
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:25.9.0-1.hum1
0:25.9.0-1.hum1
nodejs25-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:25.9.0-1.hum1
0:25.9.0-1.hum1
nodejs25-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:25.9.0-1.hum1
0:25.9.0-1.hum1
nodejs25-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:25.9.0-1.hum1
0:25.9.0-1.hum1
nodejs25-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:25.9.0-1.hum1
0:25.9.0-1.hum1
nodejs25-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:25.9.0-1.hum1
0:25.9.0-1.hum1
nodejs25-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.12.1-1.25.9.0.1.hum1
0:11.12.1-1.25.9.0.1.hum1
nodejs25-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:25.9.0-1.hum1
0:25.9.0-1.hum1
nodejs20
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:20.20.0-7.1.hum1
0:20.20.0-7.1.hum1
nodejs20-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:20.20.0-7.1.hum1
0:20.20.0-7.1.hum1
nodejs20-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:20.20.0-7.1.hum1
0:20.20.0-7.1.hum1
nodejs20-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:20.20.0-7.1.hum1
0:20.20.0-7.1.hum1
nodejs20-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:20.20.0-7.1.hum1
0:20.20.0-7.1.hum1
nodejs20-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:20.20.0-7.1.hum1
0:20.20.0-7.1.hum1
nodejs20-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:10.8.2-1.20.20.0.7.1.hum1
0:10.8.2-1.20.20.0.7.1.hum1
nodejs20-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:20.20.0-7.1.hum1
0:20.20.0-7.1.hum1
nodejs22
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:22.22.0-1.3.hum1
0:22.22.0-1.3.hum1
nodejs22-bin
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:22.22.0-1.3.hum1
0:22.22.0-1.3.hum1
nodejs22-devel
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:22.22.0-1.3.hum1
0:22.22.0-1.3.hum1
nodejs22-docs
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:22.22.0-1.3.hum1
0:22.22.0-1.3.hum1
nodejs22-full-i18n
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:22.22.0-1.3.hum1
0:22.22.0-1.3.hum1
nodejs22-libs
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:22.22.0-1.3.hum1
0:22.22.0-1.3.hum1
nodejs22-npm
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:10.9.4-1.22.22.0.1.3.hum1
0:10.9.4-1.22.22.0.1.3.hum1
nodejs22-npm-bin
Red Hat:hummingbird:1
From an advisory covering 11 CVEs
 before 0:22.22.0-1.3.hum1
0:22.22.0-1.3.hum1
nodejs
Ubuntu:25.10
 All versions, plus listed versions
20.18.1+dfsg-1ubuntu220.19.2+dfsg-120.19.4+dfsg-1
 None known
nodejs
Ubuntu:26.10
 All versions, plus listed versions
22.22.1+dfsg+~cs22.19.15-1ubuntu124.16.0+dfsg+~cs24.13.1-2ubuntu124.18.0+dfsg+~cs24.13.2-1ubuntu124.19.0+dfsg+~cs24.13.3-1ubuntu1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubPauldechassey/CVE-2026-216362026-04-27

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-21636 is a medium vulnerability (CVSS 5.8) in Nodejs Node, published January 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in node 25.3.0.

References

Show 55 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open