Improper Access Control in Node.js - CVE-2026-21711
Published: March 25, 2026
Vulnerability identifier: #VU124543
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-21711
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass permission restrictions.
The vulnerability exists due to improper access control in Unix Domain Socket (UDS) server operations in the Node.js Permission Model when binding or listening on UDS endpoints. A local user can run code with --permission but without --allow-net to create and expose local IPC endpoints, bypassing intended network restrictions.
This issue affects only environments using the experimental Permission Model with --allow-net intentionally omitted.
Affected software
Node.js
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
nodejs24 (Red Hat package)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
nodejs24 (Red Hat package)
How to mitigate CVE-2026-21711
Install security update from vendor's website.
Node.js - update to 25.8.2
nodejs24 (Red Hat package) - update to 24.14.1-2.el10_1
nodejs24 (Red Hat package) - update to 24.14.1-2.el10_1