A flaw in Node.js’s experimental Permission Model leaves Unix Domain Socket server operations without required permission checks while other network paths enforce them correctly. As a result, a Node.js process running with the --permission flag but without the --allow-net flag can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js 25.x releases that enable the Permission Model and intentionally omit --allow-net, restricting network access. Processes that do not use the experimental Permission Model or that include --allow-net are not impacted.

The CVSS score of 5.2 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and based on the description it is inferred that exploitation requires a locally running Node.js process configured with --permission and without --allow-net, thus the attack surface is primarily local. No information indicates a remote exploitation vector.