CVE-2026-21636: 
Node.js vulnerability analysis and mitigation

CVE-2026-21636 is a permission model bypass vulnerability in Node.js that allows Unix Domain Socket (UDS) connections to circumvent network restrictions even when the --permission flag is enabled. Reported by researcher mufeedvh and fixed by RafaelGSS, it was disclosed on January 20, 2026, as part of the Node.js January 13, 2026 security release. The vulnerability affects Node.js v25.x versions from 25.0.0 up to (but not including) 25.3.0. NVD assigned a CVSS v3.1 base score of 10.0 (Critical), while the CNA (HackerOne) scored it 5.8 (Medium) (Node.js Advisory, Red Hat Bugzilla).

The root cause is improper preservation of permissions (CWE-281) and improper access control (CWE-284) within Node.js's experimental permission model. When --permission is enabled but --allow-net is not specified, the permission model fails to enforce network restrictions on Unix Domain Socket (UDS) connections. Attacker-controlled inputs — such as URLs or socketPath options passed to net, tls, or undici/fetch APIs — can be used to establish connections to arbitrary local sockets, bypassing the intended security boundary entirely. This means any code path that accepts external input and passes it to these networking APIs can be weaponized to reach privileged local services without the required network permissions (Node.js Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to bypass the Node.js permission model's network restrictions and connect to arbitrary Unix Domain Sockets on the local system. This can enable unauthorized access to privileged local services (e.g., Docker sockets, database sockets, or IPC endpoints), potentially leading to privilege escalation, sensitive data exposure, or local code execution. The impact is scoped to systems running Node.js v25.x with the --permission flag enabled, particularly those where attacker-controlled input can influence socket connection parameters (Node.js Advisory, Red Hat CVE).

1. Identify a target application: Find a Node.js v25.x application running with the --permission flag enabled that accepts external user input and passes it (directly or indirectly) to net.createConnection(), tls.connect(), or undici/fetch with a socketPath or URL option.
2. Craft a malicious socket path or URL: Prepare an attacker-controlled input value that specifies a Unix Domain Socket path pointing to a privileged local service (e.g., /var/run/docker.sock, /run/containerd/containerd.sock, or a database socket).
3. Inject the payload: Supply the crafted socket path or URL through the application's input vector (e.g., an API parameter, configuration value, or user-supplied URL) so it reaches the vulnerable networking API call.
4. Establish unauthorized UDS connection: The Node.js permission model fails to check UDS connections against --allow-net restrictions, allowing the connection to proceed to the privileged local service.
5. Interact with the privileged service: Once connected, issue commands or requests to the local service (e.g., Docker API calls to spawn containers, database queries) to achieve privilege escalation, data exfiltration, or code execution (Node.js Advisory).

• Logs: Node.js application logs showing unexpected connections to Unix Domain Socket paths (e.g., /var/run/docker.sock, /run/containerd/containerd.sock, database sockets) from processes running with --permission flags; audit logs showing access to privileged socket files by the Node.js process user.
• File System: Unexpected access timestamps on privileged Unix Domain Socket files; new files or artifacts created by services accessed via the bypass (e.g., new Docker containers, database entries).
• Process: Node.js processes (node) spawning unexpected child processes or making unusual system calls to connect() targeting socket files outside the expected application scope; strace or auditd logs showing connect() syscalls to privileged UDS paths from Node.js processes.
• Network: Unusual inter-process communication activity on the host involving privileged local services immediately following external input to a Node.js application.

Upgrade Node.js to version 25.3.0 or later, which contains the fix for this vulnerability (Node.js Advisory). Organizations that cannot immediately upgrade should audit all Node.js v25.x applications using the --permission flag to identify code paths where attacker-controlled input reaches net, tls, or undici/fetch networking APIs, and sanitize or restrict such inputs. As a defense-in-depth measure, restrict the Node.js process's OS-level access to sensitive Unix Domain Sockets using filesystem permissions or Linux security modules (e.g., AppArmor, SELinux). Note that the --allow-net feature remains experimental, so relying solely on the permission model for security isolation is not recommended.

The Node.js security team credited researcher mufeedvh for reporting the vulnerability and RafaelGSS for the fix, as part of a broader January 2026 security release addressing eight vulnerabilities across all active release lines (Node.js Advisory). Security coverage outlets including CyberSecurityNews, GBHackers, SecurityOnline, and EndorLabs covered the release, noting the permission model bypass as one of the more notable issues. The EndorLabs analysis highlighted the broader pattern of Node.js permission model weaknesses addressed in this release cycle (EndorLabs). Red Hat tracked the issue as medium severity in their Bugzilla, consistent with the HackerOne CNA scoring (Red Hat Bugzilla).