Improper access control in Node.js - CVE-2026-21636

Vulnerability identifier: #VU126391

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21636

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to access privileged local services.

The vulnerability exists due to improper access control in the permission model when handling Unix Domain Socket connections without network permission checks. A local user can supply a crafted URL or socketPath to access privileged local services.

The issue affects net, tls, and undici/fetch when the permission model is enabled, and network permissions were experimental at the time.

Node.js
openEuler
npm
v8-devel
nodejs-debuginfo
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
nodejs
nodejs-debugsource

Install security update from vendor's website.

Node.js - update to 25.3.0
npm - update to 10.8.2-1.20.18.2.5
v8-devel - update to 11.3.244.8-1.20.18.2.5
nodejs-debuginfo - update to 20.18.2-5
nodejs-devel - update to 20.18.2-5
nodejs-full-i18n - update to 20.18.2-5
nodejs-libs - update to 20.18.2-5
nodejs-docs - update to 20.18.2-5
nodejs - update to 20.18.2-5
nodejs-debugsource - update to 20.18.2-5

• https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
• https://nodejs.org/en/blog/vulnerability/january-2026-security-releases

• Multiple vulnerabilities in Node.js (January 2026)
• openEuler 24.03 LTS SP1 update for nodejs
• openEuler 24.03 LTS update for nodejs
• openEuler 24.03 LTS SP3 update for nodejs
• openEuler 24.03 LTS SP2 update for nodejs