Node.js Unix Domain Socket Permission Model Bypass Vulnerability

A vulnerability in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when the permission model is enabled. Even without allowing network access, attacker-controlled inputs can connect to arbitrary local sockets through various modules, breaking the intended security boundaries and potentially leading to privilege escalation, data exposure, or local code execution. This issue affects Node.js version 25.x, at a time when network permissions were still experimental.

Impact

Exploitation of this vulnerability could allow unauthorized access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

Remediation

Users can update to Node.js versions 25.4.0, 24.13.0, or 22.22.0, all of which include the patch for this vulnerability.