Description
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
INFO
Published Date :
2026-01-20T20:41:55.700Z
Last Modified :
2026-01-21T18:52:53.133Z
Source :
hackerone
AFFECTED PRODUCTS
The following products are affected by CVE-2026-21636 vulnerability.
| Vendors | Products |
|---|---|
| Nodejs |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-21636.
