FKIE_CVE-2026-21711

Vulnerability from fkie_nvd - Published: 2026-03-30 20:16 - Updated: 2026-04-01 16:23
Severity ?
5.3 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Summary
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
References
support@hackerone.comhttps://nodejs.org/en/blog/vulnerability/march-2026-security-releases
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature."
    },
    {
      "lang": "es",
      "value": "Un fallo en la aplicaci\u00f3n de red del Modelo de Permisos de Node.js deja las operaciones del servidor de Sockets de Dominio Unix (UDS) sin las comprobaciones de permisos requeridas, mientras que todas las rutas de red comparables las aplican correctamente.\n\nComo resultado, el c\u00f3digo que se ejecuta bajo --permission sin --allow-net puede crear y exponer puntos finales IPC locales, permitiendo la comunicaci\u00f3n con otros procesos en el mismo host fuera del l\u00edmite de restricci\u00f3n de red previsto.\n\nEsta vulnerabilidad afecta a los procesos de Node.js 25.x que utilizan el Modelo de Permisos donde se omite intencionadamente --allow-net para restringir el acceso a la red. Tenga en cuenta que --allow-net es actualmente una caracter\u00edstica experimental."
    }
  ],
  "id": "CVE-2026-21711",
  "lastModified": "2026-04-01T16:23:48.813",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.4,
        "source": "support@hackerone.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-30T20:16:19.260",
  "references": [
    {
      "source": "support@hackerone.com",
      "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.