CVE-2026-21636
nodejs: Nodejs network segmentation bypass
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Red Hat (medium).
Description
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 25.3.0 |
| chainguard | nodejs-20, nodejs-22, nodejs-24 and 1 more | 20.20.0-r0 and 2 more |
| minimos | nodejs-25 | 25.3.0-r0 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| wolfi | nodejs-20, nodejs-22, nodejs-24 and 1 more | 20.20.0-r0 and 2 more |
Show all 12 entries from 5 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 25.3.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 25.3.0 |
| chainguard | nodejs-20 | 20.20.0-r0 |
| chainguard | nodejs-22 | 0 |
| chainguard | nodejs-24 | 0 |
| chainguard | nodejs-25 | 25.3.0-r0 |
| minimos | nodejs-25 | 25.3.0-r0 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| wolfi | nodejs-20 | 20.20.0-r0 |
| wolfi | nodejs-22 | 0 |
| wolfi | nodejs-24 | 0 |
| wolfi | nodejs-25 | 25.3.0-r0 |