---
id: CVE-2026-21711
title: "A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running unde…"
summary: "A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running unde…"
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-284
vendor: nodejs
product: node.js
affected:
  - node.js < 20.0.0
  - 'node.js >= 25.0.0, <= 25.8.1'
patched:
  - node.js 20.0.0
published: '2026-03-30'
updated: '2026-08-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-21711'
references:
  - url: 'https://nodejs.org/en/blog/vulnerability/march-2026-security-releases'
    label: support@hackerone.com
tags:
  - nvd
epss: 0.00175
epssPercentile: 0.06181
ingestedAt: '2026-08-19T14:40:19.164Z'
---

## Overview

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

## Affected

- `node.js < 20.0.0`
- `node.js >= 25.0.0, <= 25.8.1`

## Remediation

Upgrade past the affected range:

- `node.js 20.0.0`