A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
CVSS Details
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade v8-13.6-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18n | Apr 16, 2026 | Apr 9, 2026 |
| Oracle_linux | — | Upgrade nodejs24-docsUpgrade nodejs24-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs24-develUpgrade nodejs-develUpgrade npmUpgrade nodejs24Upgrade nodejs24-npm | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-docsUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs24-npmUpgrade nodejsUpgrade nodejs24-full-i18nUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs24-libs-debuginfoUpgrade nodejs24Upgrade nodejs-debugsource | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs24-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs24Upgrade nodejsUpgrade nodejs-develUpgrade nodejs24-develUpgrade nodejs-libs-debuginfo | Apr 13, 2026 | Apr 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub