A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade v8-13.6-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs | Apr 16, 2026 | Apr 9, 2026 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs24-develUpgrade v8-13.6-develUpgrade nodejs24Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs24-npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs24-docsUpgrade nodejs-libs | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs24-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade v8-13.6-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs24-docsUpgrade nodejs-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-develUpgrade nodejs24-npm | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade nodejs24-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs24-develUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs24-full-i18n | Apr 13, 2026 | Apr 10, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub