CVE-2026-21636
nodejs: Nodejs network segmentation bypass
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut Red Hat (mittel).
Beschreibung
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 25.3.0 |
| chainguard | nodejs-20, nodejs-22, nodejs-24 und 1 weitere | 20.20.0-r0 und 2 weitere |
| minimos | nodejs-25 | 25.3.0-r0 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| wolfi | nodejs-20, nodejs-22, nodejs-24 und 1 weitere | 20.20.0-r0 und 2 weitere |
Alle 12 Einträge aus 5 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 25.3.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 25.3.0 |
| chainguard | nodejs-20 | 20.20.0-r0 |
| chainguard | nodejs-22 | 0 |
| chainguard | nodejs-24 | 0 |
| chainguard | nodejs-25 | 25.3.0-r0 |
| minimos | nodejs-25 | 25.3.0-r0 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| wolfi | nodejs-20 | 20.20.0-r0 |
| wolfi | nodejs-22 | 0 |
| wolfi | nodejs-24 | 0 |
| wolfi | nodejs-25 | 25.3.0-r0 |