Skip to content
OpenAdvisories
Medium · 5.8 Public exploit CVE-2026-21636 EUVD-2026-3334GHSA-7xhv-hcmf-4rfv

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enab…

Published Jan 20, 2026 · Updated Jan 21, 2026 · Assigned by hackerone

Vendor: Node.js Product: node Package: nodejs Package: nodejs-20 Package: nodejs-20-doc Package: nodejs-22 Package: nodejs-22-doc Package: nodejs-24 Package: nodejs-24-doc Package: nodejs-25 Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

* The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.

Affected products

VendorProductAffectedFixed
nodejs node 25.2.1 – ≤ 25.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nodejs No fix yet —
Ubuntu 25.10 nodejs No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 nodejs20 +6 20.20.0-7.1.hum1 RHSA-2026:7386
Red Hat Hardened Images 1 nodejs20-npm 10.8.2-1.20.20.0.7.1.hum1 RHSA-2026:7386
Red Hat Hardened Images 1 nodejs22 +6 22.22.0-1.3.hum1 RHSA-2026:7387
Red Hat Hardened Images 1 nodejs22-npm 10.9.4-1.22.22.0.1.3.hum1 RHSA-2026:7387
Red Hat Hardened Images 1 nodejs24 +6 24.14.1-4.hum1 RHSA-2026:6402
Red Hat Hardened Images 1 nodejs24-npm 11.11.0-1.24.14.1.4.hum1 RHSA-2026:6402
Red Hat Hardened Images 1 nodejs25 +6 25.9.0-1.hum1 RHSA-2026:6431
Red Hat Hardened Images 1 nodejs25-npm 11.12.1-1.25.9.0.1.hum1 RHSA-2026:6431

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling nodejs-20 +1 20.20.0-r0 —
Wolfi rolling nodejs-22 +1 22.22.0-r0 —
Wolfi rolling nodejs-24 +1 24.13.0-r0 —
Wolfi rolling nodejs-25 25.3.0-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 6

References