CVE-2026-21711

Name of the Vulnerable Software and Affected Versions Node.js version 25.x

Description A flaw in the network enforcement of the Node.js Permission Model fails to apply required permission checks to Unix Domain Socket (UDS) server operations, although other comparable network paths are correctly enforced. This allows code executed with the --permission flag and without the --allow-net flag to create and expose local Inter-Process Communication (IPC) endpoints. Consequently, this enables communication with other processes on the same host, bypassing the intended network restriction boundary. The --allow-net feature is currently experimental.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.