Node.js Permission Model Unix Domain Socket Network Restriction Bypass
CVE-2026-21636 is a medium-severity flaw in the experimental Node.js permission model affecting Node.js v25. When Node.js is started with --permission, Unix Domain Socket (UDS) connections are not properly constrained by network permission checks. As a result, even when --allow-net is not granted, attacker-controlled inputs such as URLs or socketPath options can cause APIs including net, tls, and undici/fetch to connect to arbitrary local Unix sockets. This creates a gap in the intended permission boundary by treating local socket access as effectively outside the enforced network restrictions.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
socketPath values used by net, tls, undici, or fetch. Where untrusted code must run, enforce isolation with OS- or container-level controls such as filesystem permissions on socket files, service hardening, containers, seccomp, AppArmor, or SELinux, and restrict access to sensitive local Unix sockets.Remediation
Patch, then assume compromise.
net, tls, undici, or fetch connection parameters, especially socketPath and URL-derived targets, and remove assumptions that the experimental permission model alone will block local socket access.Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a working proof-of-concept exploit for CVE-2026-21636, a Node.js permission model bypass affecting local TCP/UDS connectivity. The repo contains a Python exploit client (exploit.py) and a self-contained vulnerable lab under vuln_server/. The lab launches two Node.js processes under supervisord: a sandboxed Express server (server.mjs) started with --permission --allow-fs-read=/ and no --allow-net, and an unsandboxed helper process (target.cjs). The vulnerable web server exposes GET /pid, which returns the helper PID from /tmp/target.pid, and POST /language, which dynamically imports attacker-controlled input. The exploit abuses the import sink with a data:text/javascript payload to achieve arbitrary JavaScript execution inside the sandboxed process. It then sends SIGUSR1 to the unsandboxed helper process to enable the V8 inspector on 127.0.0.1:9229, uses fetch('http://127.0.0.1:9229/json') and a WebSocket connection to ws://127.0.0.1:9229/<id> from inside the sandboxed process, and leverages the Chrome DevTools Protocol Runtime.evaluate method to run process.mainModule.require('child_process').execSync('cat /app/secret.txt').toString() in the unsandboxed process. This demonstrates that localhost network access succeeds despite the absence of --allow-net, allowing a sandbox escape/pivot to arbitrary command execution. The repository is not part of a known exploit framework, is not merely a detector, and is best classified as an operational PoC with a hardcoded payload and a reproducible Docker environment.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.