CVE-2026-21636

描述

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.

如何修補 CVE-2026-21636

要修補 CVE-2026-21636,請將受影響套件升級到下列已修補版本。

• —升級至 25.3.0 或更新版本
• —升級至 25.3.0 或更新版本

CVE-2026-21636 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 25.0.0, < 25.3.0
• >= 25.0.0, < 25.3.0

CVSS 分數

參考連結(2)

• WEBnodejs.org/en/blog/vulnerability/december-2025-security-releases
• WEBnvd.nist.gov/vuln/detail/CVE-2026-21636