Node.js Permission Model Bypass Vulnerability in Unix Domain Socket Server Operations

A vulnerability exists in Node.js 25.x processes using the Permission Model, where the 'allow-net' option is omitted to restrict network access. This flaw allows Unix Domain Socket (UDS) server operations to bypass necessary permission checks, enabling code to create and expose local IPC endpoints. Consequently, communication can occur with other processes on the same host, circumventing intended network restrictions.

Impact

Exploitation of this vulnerability allows for unauthorized creation and exposure of local IPC endpoints, enabling communication with other processes on the same host outside of permitted network boundaries.

Remediation

Users can update to Node.js versions 25.8.2, 24.14.1, or 22.22.2 to address this vulnerability.