CVE-2026-21711: 
npm vulnerability analysis and mitigation

CVE-2026-21711 is a Permission Model bypass vulnerability in Node.js 25.x that allows code running under --permission without --allow-net to create and expose Unix Domain Socket (UDS) server endpoints without the required permission checks. This enables unauthorized inter-process communication (IPC) with other processes on the same host, circumventing the intended network restriction boundary. The vulnerability was reported by researcher xavlimsg and fixed by RafaelGSS, with the advisory published on March 30, 2026. It carries a CVSS v3.0 base score of 5.3 (Medium) (Node.js Advisory, GitHub Advisory).

The root cause is an incomplete enforcement of network access controls within the Node.js Permission Model, classified as CWE-284 (Improper Access Control) and CWE-940 (Improper Verification of Source of a Communication Channel). While TCP and other network paths correctly enforce the --allow-net permission flag, UDS server bind/listen operations bypass this check entirely, allowing restricted code to create local IPC endpoints. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it straightforward for any local process running under the affected Permission Model configuration to exploit. The --allow-net feature is currently experimental in Node.js, meaning this flaw specifically affects environments that have opted into the experimental Permission Model (Node.js Advisory, GitHub Advisory).

Successful exploitation allows a local attacker with low privileges to establish unauthorized IPC channels via Unix Domain Sockets, bypassing the network isolation boundary enforced by --permission without --allow-net. This can result in low-level confidentiality, integrity, and availability impacts depending on what sensitive processes or data are accessible via local IPC on the same host. The scope is limited to the local system (unchanged scope), but the ability to communicate with privileged or sensitive processes could facilitate further privilege escalation or data exfiltration in multi-process environments (Node.js Advisory, GitHub Advisory).

1. Identify target: Locate a system running Node.js 25.x with the Permission Model enabled (--permission flag) and --allow-net intentionally omitted to restrict network access.
2. Gain local access: Obtain local code execution on the target system with at least low-level privileges (e.g., as a restricted application or sandboxed script running under the Permission Model).
3. Create a UDS server: Within the restricted Node.js process, use the net module to bind and listen on a Unix Domain Socket path (e.g., net.createServer().listen('/tmp/malicious.sock')). This operation succeeds despite the absence of --allow-net due to the missing permission check.
4. Expose IPC endpoint: Other processes on the same host can now connect to the exposed UDS endpoint, enabling bidirectional communication outside the intended network restriction boundary.
5. Communicate with sensitive processes: Use the unauthorized IPC channel to interact with other local processes, potentially exfiltrating data, injecting commands, or escalating privileges depending on the target process's capabilities (Node.js Advisory).

• File System: Unexpected Unix Domain Socket files (.sock files) created in /tmp or application directories by Node.js processes that should not have network access.
• Process: Node.js 25.x processes launched with --permission (and without --allow-net) that have open UDS file descriptors, detectable via lsof -U or ss -x.
• Logs: Application or audit logs showing Node.js processes binding to socket paths unexpectedly; OS-level audit logs (e.g., auditd) recording bind() or listen() syscalls on AF_UNIX sockets from restricted Node.js processes.
• Network: Unusual inter-process communication activity on the host via Unix Domain Sockets between processes that should be isolated from each other.

Upgrade Node.js 25.x to version 25.8.2, which contains the fix for this vulnerability. Red Hat Enterprise Linux users should apply RHSA-2026:7350 (RHEL 9), RHSA-2026:7670 (RHEL 8), or RHSA-2026:7675 (RHEL 10) as appropriate. IBM API Connect users should refer to IBM security advisory 7272626. As a workaround for systems that cannot immediately patch, restrict execution of untrusted code on hosts running Node.js 25.x with the Permission Model, and audit local process communications for unauthorized UDS activity. Organizations should also review all deployments using the --permission flag to understand the current security assumptions given this enforcement gap (Node.js Advisory, Red Hat Bugzilla, IBM Advisory).

The Node.js project disclosed this vulnerability as part of a broader March 2026 security release that addressed nine CVEs across multiple release lines, with CVE-2026-21711 rated Medium severity. Red Hat promptly issued errata for RHEL 8, 9, and 10, and IBM addressed the issue in API Connect. Security blogs including The Cyber Express, HeroDevs, and SecPod covered the March 2026 Node.js security release, though coverage focused primarily on the higher-severity issues (CVE-2026-21637 and CVE-2026-21710) rather than this specific vulnerability (Node.js Advisory, Red Hat Bugzilla).