CVE-2026-21711 Security feature bypass in node

What is CVE-2026-21711?

CVE-2026-21711 is a medium-severity vulnerability in Nodejs Node.js, published on 30 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

Weakness: CWE-284

Which versions are affected by CVE-2026-21711?

2 open source packages ship an affected version, including node and node-min. It affects 1 product.

Products include Nodejs Node.js.

How do I fix CVE-2026-21711?

Upgrade node to 25.8.2 or later.

Is CVE-2026-21711 being exploited?

There is no known exploitation of CVE-2026-21711 in the wild and no public exploit code.

Other vulnerabilities in Nodejs Node.js

• CVE-2023-32002 Security feature bypass in Node Critical 9.8
• CVE-2016-6303 Integer overflow in n/a Critical 9.8
• CVE-2017-15896 Security feature bypass in Node.js Critical 9.1
• CVE-2018-7160 Server-side request forgery in Node.js High 8.8
• CVE-2018-12120 Misconfiguration in Node.js High 8.1

All Nodejs Node.js vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-node-2026-21711, BIT-node-min-2026-21711, GHSA-vcqx-cqfc-xc2r, MINI-8rfx-g9j3-xg28, UBUNTU-CVE-2026-21711.