CVE-2026-21711

score

<0.1

cvss

5.3

epss

0.2%

published

2026-03-30

kev added

—

first seen

2026-10-21

Node.js 25.x contains a broken access control vulnerability caused by missing permission checks on Unix Domain Socket server operations, letting attackers create local IPC endpoints bypassing network restrictions, exploit requires running with --permission and without --allow-net.