CVE-2026-21711: A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.
This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Overview
- Severity
- Medium (CVSS 5.3)
- CVSS Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Exploit Status
- Not Exploited
- Patch Tuesday
- 2026-Mar
- Released
- 2026-04-01
- Last Updated
- 2026-06-02
- EPSS Score
- 0.15% (percentile: 4.3%)
Affected Products (4)
Other
- 21259-17084
- 21192-17084
- 21370-17084
Open Source Software
- azl3 nodejs24 24.13.0-3 on Azure Linux 3.0
Revision History
- 2026-04-01: Information published.
- 2026-04-14: Information published.
- 2026-04-29: Information published.
- 2026-05-31: Information published.
- 2026-06-01: Information published.
- 2026-06-02: Information published.