Vulnerability · Published Jan 20, 2026 · Assigned by hackerone
CVE-2026-21636
Medium 5.8
In plain English
A medium-severity improper access control in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:25.10 | nodejs | no fix listed | UBUNTU-CVE-2026-21636 |
| Ubuntu:26.10 | nodejs | no fix listed | UBUNTU-CVE-2026-21636 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N