A flaw in Node.js’s permission model allows Unix Domain Socket connections to bypass network restrictions when the --permission flag is enabled. Even without the --allow-net flag, attacker‑controlled inputs such as URLs or socketPath options can connect to arbitrary local sockets through the net, tls, or undici/fetch APIs. This violates the intended security boundary and lets an attacker access privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. The weakness involves improper access control (CWE‑284) and flawed permission handling (CWE‑281).

Node.js version 25 on any platform that uses the experimental permission model. Users of the nodejs:node product are affected.

The CVSS score is 10.0, indicating maximum severity, while the EPSS score is below 1 %, suggesting exploitation frequency is low at this time. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires a Node.js process run with the --permission flag, plus input from an attacker that can provide a malicious URL or socket path. The attacker can then establish connections to privileged Unix domain sockets, breach local isolation, and potentially gain local privilege escalation or execute code on the host. The experimental nature of network permissions means the attack surface is limited to environments that have enabled these features, but the impact remains severe once the flaw is present.