CVE-2026-21636

score

<0.1

cvss

10.0

epss

0.9%

published

2026-01-20

kev added

—

first seen

2026-10-21

Node.js v25 contains a privilege escalation caused by Unix Domain Socket connections bypassing network restrictions in the permission model, letting attackers access privileged local services, exploit requires --permission enabled.