CVE-2026-21711: Node.js Privilege Escalation Vulnerability

CVE-2026-21711 Overview

A security flaw has been identified in the Node.js Permission Model's network enforcement mechanism. The vulnerability specifically affects Unix Domain Socket (UDS) server operations, which fail to undergo the required permission checks that are correctly applied to all other comparable network paths.

This bypass allows code running under the --permission flag without --allow-net to create and expose local IPC endpoints, enabling unauthorized communication with other processes on the same host. This behavior circumvents the intended network restriction boundary established by the Permission Model.

Critical Impact

Processes running under Node.js Permission Model restrictions can bypass network access controls through Unix Domain Sockets, potentially enabling unauthorized inter-process communication and security boundary violations.

Affected Products

• Node.js 25.x (when using Permission Model without --allow-net)
• Applications utilizing --permission flag to restrict network access
• Systems relying on Permission Model for security isolation

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-21711 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-21711

Vulnerability Analysis

The vulnerability stems from an inconsistency in how the Node.js Permission Model enforces network restrictions. While standard network operations (TCP/UDP sockets, HTTP requests, etc.) correctly require the --allow-net permission flag before execution, Unix Domain Socket server operations were inadvertently omitted from these enforcement checks.

This creates a security gap where applications explicitly configured to run without network access can still establish local IPC communication channels. The local attack vector requires an attacker to have existing access to the target system, but once exploited, it can compromise the integrity of security isolation boundaries that administrators expect from the Permission Model.

The root cause is classified under CWE-284 (Improper Access Control), as the system fails to properly restrict access to a privileged function—in this case, creating network-style communication endpoints via Unix Domain Sockets.

Root Cause

The vulnerability exists due to missing permission validation logic in the Unix Domain Socket server creation path within Node.js. While the Permission Model was designed to comprehensively restrict network access when --allow-net is omitted, the UDS server binding operations were not included in the enforcement scope. This oversight means the permission checking framework that gates TCP/IP operations does not extend to UDS-based communication, creating an unintended bypass.

Attack Vector

An attacker with local access to a system running Node.js 25.x with the Permission Model enabled (but --allow-net disabled) can exploit this vulnerability by:

1. Creating a Unix Domain Socket server within the restricted Node.js process
2. Exposing the UDS endpoint to allow other local processes to connect
3. Establishing communication channels that bypass the intended network restriction
4. Using the IPC channel to exfiltrate data or receive commands from other processes

The exploitation does not require user interaction and can be performed with low privileges on the system.

The vulnerability allows applications that are supposed to be network-isolated to establish local IPC endpoints using Unix Domain Sockets. When a Node.js application uses net.createServer() bound to a Unix socket path, the Permission Model fails to validate whether the --allow-net permission was granted, allowing the server to be created and accept connections from other local processes.

Detection Methods for CVE-2026-21711

Indicators of Compromise

• Unexpected Unix Domain Socket files created by Node.js processes running with --permission flag
• Node.js processes without --allow-net permission establishing IPC communication
• Suspicious socket files in /tmp or application directories created by permission-restricted processes
• Anomalous inter-process communication patterns involving Node.js applications

Detection Strategies

• Monitor for Unix Domain Socket creation events from Node.js processes running under Permission Model restrictions
• Audit process command lines for --permission flag usage without corresponding --allow-net
• Implement file integrity monitoring on directories commonly used for Unix socket endpoints
• Review application logs for unexpected socket binding operations

Monitoring Recommendations

• Enable audit logging for socket system calls on systems running Node.js 25.x with Permission Model
• Deploy endpoint detection to monitor for UDS-based IPC from restricted Node.js processes
• Establish baseline behavior for permitted network operations and alert on deviations
• Monitor the experimental Permission Model feature usage across your Node.js deployments

How to Mitigate CVE-2026-21711

Immediate Actions Required

• Review all Node.js 25.x deployments using the Permission Model with restricted network access
• Assess the risk of potential UDS-based communication bypass in your environment
• Apply the security patch when available from Node.js
• Consider alternative isolation mechanisms if immediate patching is not possible

Patch Information

Node.js has released security updates addressing this vulnerability. For detailed patch information and updated versions, refer to the Node.js Security Release Blog.

Organizations should update to the patched version of Node.js 25.x as soon as the fix is available. The patch adds proper permission checking for Unix Domain Socket server operations, ensuring consistency with other network path enforcement.

Workarounds

• Avoid relying solely on the Permission Model for network isolation in security-critical applications
• Use operating system-level network namespaces or containers to enforce network restrictions
• Implement additional application-level controls to prevent unauthorized socket creation
• Monitor and restrict file system access to directories where Unix sockets could be created

# Configuration example
# Use container-level network isolation as an additional security layer
# Run Node.js application in a network-restricted container namespace
docker run --network=none \
  --security-opt=no-new-privileges:true \
  node:25-alpine node --permission app.js

# Alternatively, use Linux network namespaces for isolation
unshare --net -- node --permission app.js