CVE-2026-21636
nodejs: Nodejs network segmentation bypass
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD, Bitnami. Plus basse selon Red Hat (moyenne).
Description
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 25.3.0 |
| chainguard | nodejs-20, nodejs-22, nodejs-24 et 1 autres | 20.20.0-r0 et 2 autres |
| minimos | nodejs-25 | 25.3.0-r0 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| wolfi | nodejs-20, nodejs-22, nodejs-24 et 1 autres | 20.20.0-r0 et 2 autres |
Afficher les 12 entrées de 5 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 25.3.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 25.3.0 |
| chainguard | nodejs-20 | 20.20.0-r0 |
| chainguard | nodejs-22 | 0 |
| chainguard | nodejs-24 | 0 |
| chainguard | nodejs-25 | 25.3.0-r0 |
| minimos | nodejs-25 | 25.3.0-r0 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| wolfi | nodejs-20 | 20.20.0-r0 |
| wolfi | nodejs-22 | 0 |
| wolfi | nodejs-24 | 0 |
| wolfi | nodejs-25 | 25.3.0-r0 |