Every CVE Search/ Get API key

CVE-2026-21711

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...

5.3 MediumFix available

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.17%Up 0.2 points since Mar 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
CVE-2026-21711
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2026-17172 5.3

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
EUVD-2026-17172
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-vcqx-cqfc-xc2r 5.3

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
GHSA-vcqx-cqfc-xc2r
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-284
Updated
2026-11-02
NVD 5.3

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
CVE-2026-21711
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-284
Updated
2026-11-02
OSVBELL-CVE-2026-21711 5.3

CVE-2026-21711 does not affect BellSoft software

Record
BELL-CVE-2026-21711
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSV 5.3

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
CVE-2026-21711
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 12 moreShow less
OSVRHSA-2026:7350 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7670 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7675 7.5

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7350 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7670 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7675 7.5

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-21711 5.3

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
UBUNTU-CVE-2026-21711
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVALSA-2026:7350 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7350
Updated
2026-11-02
OSVALSA-2026:7670 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7670
Updated
2026-11-02
OSVALSA-2026:7675 No score

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7675
Updated
2026-11-02
OSVBIT-node-2026-21711 No score

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
BIT-node-2026-21711
Updated
2026-11-02
OSVBIT-node-min-2026-21711 No score

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

Record
BIT-node-min-2026-21711
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+198+8bf605ba
2021.06-6.module_el9.7.0+198+8bf605ba
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
Show 63 moreShow less
Affected packages
PackageAffectedFixed
nodejs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-docs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-libs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-nodemon
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
v8-13.6-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
node
Bitnami
 25.0.0 up to 25.8.2
25.8.2
node-min
Bitnami
 25.0.0 up to 25.8.2
25.8.2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module+el9.7.0+24166+51c9666b
1:24.14.1-2.module+el9.7.0+24166+51c9666b
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+24166+51c9666b
0:3.0.3-3.module+el9.7.0+24166+51c9666b
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+24166+51c9666b
0:2021.06-6.module+el9.7.0+24166+51c9666b
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+24166+51c9666b
0:2021.06-6.module+el9.7.0+24166+51c9666b
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b
1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b
3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module+el8.10.0+24190+49a46c75
1:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+24190+49a46c75
0:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+24190+49a46c75
0:2021.06-6.module+el8.10.0+24190+49a46c75
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75
3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75
nodejs24
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-docs
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-full-i18n
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
Red Hat:enterprise_linux:10.1
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
nodejs-nodemon
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs24
Rocky Linux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.10.15~dfsg1-40.10.21~dfsg1-10.10.22~dfsg1-20.10.23~dfsg1-10.10.23~dfsg1-2
Show 7 moreShow less
0.10.23~dfsg1-30.10.24~dfsg1-10.10.25~dfsg2-20.10.25~dfsg2-2ubuntu10.10.25~dfsg2-2ubuntu1.20.10.25~dfsg2-2ubuntu1.2+esm10.10.25~dfsg2-2ubuntu1.2+esm2
 None known
nodejs
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 7 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm14.2.6~dfsg-1ubuntu4.2+esm24.2.6~dfsg-1ubuntu4.2+esm3
 None known
nodejs
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 10 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm18.10.0~dfsg-2ubuntu0.4+esm28.10.0~dfsg-2ubuntu0.4+esm38.10.0~dfsg-2ubuntu0.4+esm48.10.0~dfsg-2ubuntu0.4+esm58.10.0~dfsg-2ubuntu0.4+esm6
 None known
nodejs
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu110.19.0~dfsg-3ubuntu1.1
Show 5 moreShow less
10.19.0~dfsg-3ubuntu1.210.19.0~dfsg-3ubuntu1.310.19.0~dfsg-3ubuntu1.510.19.0~dfsg-3ubuntu1.610.19.0~dfsg-3ubuntu1.6+esm2
 None known
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
nodejs
Ubuntu:24.04:LTS
 All versions, plus listed versions
18.13.0+dfsg1-1ubuntu218.19.1+dfsg-2ubuntu418.19.1+dfsg-6ubuntu118.19.1+dfsg-6ubuntu218.19.1+dfsg-6ubuntu5
 None known
nodejs
Ubuntu:25.10
 All versions, plus listed versions
20.18.1+dfsg-1ubuntu220.19.2+dfsg-120.19.4+dfsg-1
 None known
nodejs
Ubuntu:26.10
 All versions, plus listed versions
22.22.1+dfsg+~cs22.19.15-1ubuntu124.16.0+dfsg+~cs24.13.1-2ubuntu124.18.0+dfsg+~cs24.13.2-1ubuntu124.19.0+dfsg+~cs24.13.3-1ubuntu1
 None known
nodejs
Ubuntu:26.04:LTS
 All versions, plus listed versions
20.19.4+dfsg-120.19.5+dfsg+~cs20.19.12-422.21.1+dfsg+~cs22.19.0-6ubuntu422.22.0+dfsg+~cs22.19.6-1ubuntu222.22.0+dfsg+~cs22.19.13-2ubuntu122.22.1+dfsg+~cs22.19.15-1ubuntu1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-21711 is a medium vulnerability (CVSS 5.3) in Nodejs Node, published March 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 5th percentile. Fixed in node 25.8.2.

References

Show 127 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open