A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| nodejs | node | 25.8.1 – ≤ 25.8.1, 4.0 – < 4.*, 5.0 – < 5.*, 6.0 – < 6.*, 7.0 – < 7.*, 8.0 – < 8.*, 9.0 – < 9.*, 10.0 – < 10.*, 11.0 – < 11.*, 12.0 – < 12.*, 13.0 – < 13.*, 14.0 – < 14.*, 15.0 – < 15.*, 16.0 – < 16.*, 17.0 – < 17.*, 18.0 – < 18.*, 19.0 – < 19.* | |
| nodejs | node.js | < 20.0.0 |
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* < 20.0.0cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 25.0.0 ≤ 25.8.1Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.