PT-2026-3317 · Node.Js · Node.Js

Mufeedvh · Published 2026-01-13 · Updated 2026-05-06 · CVE-2026-21636

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Node.js version 25

Description A flaw in the permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs, such as URLs or socketPath options, can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. The network permissions (--allow-net) are currently in the experimental phase.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2026-01353

BIT-NODE-2026-21636

BIT-NODE-MIN-2026-21636

CVE-2026-21636

RHSA-2026:6402

RHSA-2026:6431

RHSA-2026:7386

RHSA-2026:7387

Affected Products

Node.Js

References · 17

• https://nodejs.org/en/blog/vulnerability/december-2025-security-releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21636 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21636 · Security Note
• https://ubuntu.com/security/CVE-2026-21636 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21636 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21636 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01353 · Security Note
• https://osv.dev/vulnerability/BIT-node-min-2026-21636 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2026-21636 · Vendor Advisory
• https://reddit.com/r/TrendNowOrg/comments/1qoui9t/moltbot_the_opensource_ai_assistant_that_took · Reddit Post
• https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#nodejs-permission-model-bypass-via-unchecked-unix-domain-socket-connections-uds-cve-2026-21636---medium · Note
• https://reddit.com/r/u_Weekly-Aide-6394/comments/1qwe1tw/openclaw_the_123000star_ai_revolution_or_a · Reddit Post
• https://twitter.com/winfunction/status/2012163130265366707 · Twitter Post
• https://twitter.com/CCBalert/status/2052031183689568407 · Twitter Post
• https://twitter.com/grok/status/2012777550611624191 · Twitter Post