ZeroDay Findings
Sign inSign up

Findings

CVE-2026-21711

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable n…

Published Mar 30, 2026 · updated Aug 19, 2026 · nodejs node.js

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under without can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where is intentionally omitted to restrict network access. Note that is currently an experimental feature.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 30, 2026 · NIST NVD

    Detected

    A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under without can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary

  2. Aug 19, 2026 · NIST NVD

    Updated

    A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under without can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary

Affected

  • cpe nodejs/node.jsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-21711

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-21711

    A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under without can

    nvd.nist.gov

References