{"id":"CVE-2026-21711","aliases":["ALSA-2026:7350","ALSA-2026:7670","ALSA-2026:7675","BELL-CVE-2026-21711","BIT-node-2026-21711","BIT-node-min-2026-21711","EUVD-2026-17172","GHSA-vcqx-cqfc-xc2r","RHSA-2026:7350","RHSA-2026:7670","RHSA-2026:7675","RLSA-2026:7350","RLSA-2026:7670","RLSA-2026:7675","UBUNTU-CVE-2026-21711"],"status":"published","title":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00166,"percentile":0.05984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-03-29T06:09:33.746603Z","modified":"2026-10-29T11:32:37Z","fixes":[{"ecosystem":"Bitnami","package":"node","fixed_in":["25.8.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["25.8.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+198+8bf605ba"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.module_el8.10.0+4061+f8ceeab9"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"25.8.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"25.8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-1.module+el8.10.0+2084+ab509703"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2","0.10.25~dfsg2-2ubuntu1.2+esm1","0.10.25~dfsg2-2ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2","10.19.0~dfsg-3ubuntu1.3","10.19.0~dfsg-3ubuntu1.5","10.19.0~dfsg-3ubuntu1.6","10.19.0~dfsg-3ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.18.1+dfsg-1ubuntu2","20.19.2+dfsg-1","20.19.4+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.22.1+dfsg+~cs22.19.15-1ubuntu1","24.16.0+dfsg+~cs24.13.1-2ubuntu1","24.18.0+dfsg+~cs24.13.2-1ubuntu1","24.19.0+dfsg+~cs24.13.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-4","22.21.1+dfsg+~cs22.19.0-6ubuntu4","22.22.0+dfsg+~cs22.19.6-1ubuntu2","22.22.0+dfsg+~cs22.19.13-2ubuntu1","22.22.1+dfsg+~cs22.19.15-1ubuntu1"]}],"products":[{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","tags":["Vendor Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21711","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vcqx-cqfc-xc2r"},{"url":"https://access.redhat.com/errata/RHSA-2026:7350","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1525","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1526","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1527","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1528","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21637","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21710","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21711","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21712","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21714","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21715","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21716","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2229","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25547","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2581","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27135","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453151","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453157","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453161","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453162","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-7350.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7670","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7670.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7675","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7675.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-21711","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21711.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453162","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7350.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://cwe.mitre.org/data/definitions/444.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm","tags":["article"]},{"url":"https://hackerone.com/reports/3556037","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc7692","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q","tags":["article"]},{"url":"https://hackerone.com/reports/3481206","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1527","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","tags":["article"]},{"url":"https://hackerone.com/reports/3487198","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1528","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj","tags":["article"]},{"url":"https://hackerone.com/reports/3537648","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","tags":["article"]},{"url":"https://hackerone.com/reports/3487486","tags":["article"]},{"url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2581","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h","tags":["article"]},{"url":"https://hackerone.com/reports/3513473","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21710","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21711","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21712","tags":["advisory"]},{"url":"https://hackerone.com/reports/3546390","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21713","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21714","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21715","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21716","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21717","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25547","tags":["advisory"]},{"url":"https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","tags":["article"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-151374","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7670.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7675.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7350","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7670","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7675","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-21711","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#nodejs-permission-model-bypass-uds-server-bindlisten-works-without---allow-net-cve-2026-21711---medium","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-21711","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-03-30T19:07:28.526Z","modified":"2026-04-01T15:03:21.612Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:41:42.05254Z"}],"euvd":[{"id":"EUVD-2026-17172","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-03-30T19:07:28Z","modified":"2026-04-01T15:03:21Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:25:24.09733Z"}],"ghsa":[{"id":"GHSA-vcqx-cqfc-xc2r","title":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\n\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\n\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-03-30T21:31:04Z","modified":"2026-04-01T18:36:46Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:07:04.310482Z"}],"nvd":[{"id":"CVE-2026-21711","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-03-30T20:16:19.26Z","modified":"2026-08-19T13:52:49.31Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"BELL-CVE-2026-21711","title":"CVE-2026-21711 does not affect BellSoft software","status":"withdrawn","published":"2026-03-29T06:09:33.746603Z","modified":"2026-04-01T07:16:22.82006Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-21711","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-03-30T19:07:28.526Z","modified":"2026-10-28T02:30:40.630060477Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"RHSA-2026:7350","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-04-10T10:09:15Z","modified":"2026-10-20T10:15:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7670","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-04-13T10:07:20Z","modified":"2026-10-20T10:15:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7675","title":"Red Hat Security Advisory: nodejs24 security update","status":"published","published":"2026-04-13T10:07:23Z","modified":"2026-10-20T10:16:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-10T00:04:09.070331Z","modified":"2026-04-10T00:30:06.392552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7670","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-13T06:01:13.567166Z","modified":"2026-04-13T06:30:06.733151Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7675","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:07:10.074197Z","modified":"2026-04-15T12:30:34.977687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-21711","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-03-30T20:16:00Z","modified":"2026-10-17T12:58:06.670320619Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"ALSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-10-29T11:32:37.577752858Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7670","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:02:29.661659123Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7675","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:30:49.714638043Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"BIT-node-2026-21711","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-04-06T07:58:30.648Z","modified":"2026-09-08T08:48:10.768531439Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2026-21711","description":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.","status":"published","published":"2026-04-06T07:58:44.713Z","modified":"2026-09-08T08:48:17.418241483Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}