A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
CVSS Details
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npm | Apr 16, 2026 | Apr 9, 2026 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs24-full-i18nUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs24-libsUpgrade nodejs24-docsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs24-npmUpgrade nodejs-docsUpgrade npmUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs-devel | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs24Upgrade nodejs-develUpgrade npmUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs24-develUpgrade nodejs24-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-docsUpgrade nodejs-full-i18nUpgrade nodejs24-npm | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs | Apr 13, 2026 | Apr 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub