Permission Bypass in Node.js 25.x UDS Server Operations

Executive Summary

This vulnerability is a flaw in the Node.js Permission Model related to network enforcement. Specifically, Unix Domain Socket (UDS) server operations do not have the required permission checks, unlike other network paths which enforce these checks correctly.

Because of this flaw, code running with the Node.js permission flag `--permission` but without the `--allow-net` flag can still create and expose local inter-process communication (IPC) endpoints. This allows communication with other processes on the same host, bypassing the intended network restriction.

This affects Node.js version 25.x processes that use the Permission Model and intentionally omit the `--allow-net` flag to restrict network access. Note that `--allow-net` is an experimental feature.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized local communication between processes on the same host. Even if network access is restricted by omitting the `--allow-net` permission, an attacker or malicious code could create Unix Domain Socket servers to communicate locally, potentially bypassing intended network restrictions.

This could lead to information leakage, unauthorized data access, or interference between processes that were supposed to be isolated by network permission controls.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that Node.js processes using the Permission Model do not omit the `--allow-net` flag if network restrictions are intended.

Since the flaw allows Unix Domain Socket server operations to bypass permission checks when `--allow-net` is omitted, explicitly including `--allow-net` or avoiding use of the experimental Permission Model feature until a fix is available can reduce risk.

Additionally, review and restrict local IPC endpoint exposure to trusted processes only.

Useful 0 Not Useful 0