Description
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
CVSS breakdown
CVSS 3.0
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected products
- nodejs / node25.8.1 – 25.8.1
- nodejs / node4.0 – 4.*
- nodejs / node5.0 – 5.*
- nodejs / node6.0 – 6.*
- nodejs / node7.0 – 7.*
- nodejs / node8.0 – 8.*
- nodejs / node9.0 – 9.*
- nodejs / node10.0 – 10.*
- nodejs / node11.0 – 11.*
- nodejs / node12.0 – 12.*
- nodejs / node13.0 – 13.*
- nodejs / node14.0 – 14.*
- nodejs / node15.0 – 15.*
- nodejs / node16.0 – 16.*
- nodejs / node17.0 – 17.*
- nodejs / node18.0 – 18.*
- nodejs / node19.0 – 19.*
- nodejs / node.js20.0.0
Updated 5m ago · 8 sources