PT-2026-29099 · Node.Js+1 · Node.Js+1

Xavlimsg · Published 2026-03-30 · Updated 2026-04-13 · CVE-2026-21711

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Node.js versions 25.x

Description A flaw in the Node.js Permission Model’s network enforcement allows Unix Domain Socket (UDS) server operations to proceed without the necessary permission checks. All other network paths correctly enforce these checks. Consequently, code running under --permission without --allow-net can create and expose local Inter-Process Communication (IPC) endpoints, enabling communication with other processes on the same host, bypassing the intended network restriction boundary. The --allow-net feature is currently experimental.

Recommendations For Node.js version 25.x, avoid running processes under --permission without including the --allow-net flag to restrict network access.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALSA-2026:7350

ALSA-2026:7670

ALSA-2026:7675

BIT-NODE-2026-21711

BIT-NODE-MIN-2026-21711

CVE-2026-21711

RHSA-2026:7350

RHSA-2026:7670

RHSA-2026:7675

Affected Products

Node.Js

Rocky Linux

References · 59

• https://nvd.nist.gov/vuln/detail/CVE-2026-21711 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21711 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-7670.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2026-21711 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21711 · Security Note
• https://ubuntu.com/security/CVE-2026-21711 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-7675.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:7350 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-7350.html · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-7670.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:7670 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-7350.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-min-2026-21711 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:7670 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:7350 · Vendor Advisory