critical CVSS 10

CVE-2026-21636·Node.js vulnerability

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.

Severity
critical
Software
Node.js
Fixed in
25.3.0
Published
2026-01-20

Affected versions

From: 25.0.0

Until: 25.3.0

Fixed in: 25.3.0

How to fix this CVE

Upgrade Node.js to version 25.3.0 or later to patch the Unix Domain Socket permission bypass vulnerability. This vulnerability allows attackers to circumvent the `--permission` flag and connect to local sockets even when `--allow-net` is not granted, potentially exposing privileged services. Immediate patching is critical for production environments relying on Node.js permission model enforcement.

sudo dnf update nodejs

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check your current Node.js version by running `node --version` and confirm if it falls within the affected range (25.0.0 to 25.3.0)
  2. Step 2: Determine if the `--permission` flag is actively used in your Node.js startup scripts or process managers by grep-ing init scripts: `grep -r '\-\-permission' /etc/systemd/ /etc/init.d/ ~/.bashrc`
  3. Step 3: Search application and system logs for unauthorized UDS connection attempts to privileged sockets by searching logs: `journalctl -u nodejs -b | grep -i 'socket\|connection\|permission' && grep -i 'EACCES\|EPERM' /var/log/app.log`
  4. Step 4: After upgrading, verify the patched version is running with `node --version` and restart the Node.js service: `sudo systemctl restart nodejs`

FAQ

What is CVE-2026-21636?

CVE-2026-21636 is a critical permission model bypass in Node.js v25 that allows unauthenticated attackers to connect to arbitrary Unix Domain Sockets (UDS) through net, tls, or fetch APIs, bypassing the intended `--permission` security restrictions.

Is CVE-2026-21636 being actively exploited?

No, CVE-2026-21636 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits have been released. However, the critical CVSS 10 rating and low complexity of exploitation warrant immediate patching.

What versions of Node.js are affected by CVE-2026-21636?

Node.js versions 25.0.0 through 25.3.0 are affected. Version 25.3.0 and later include the security patch.

How do I check if my server is vulnerable to CVE-2026-21636?

Run `node --version` and if the output shows v25.0.0 to v25.3.0, your server is vulnerable. Additionally, verify if `--permission` flag is enabled in your Node.js startup configuration.

Does Defensia detect CVE-2026-21636?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Node.js is installed on a monitored server, CVE-2026-21636 will appear in your dashboard with remediation steps.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-21636. Free for 1 server.

Get started free