A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network     restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such     as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This     breaks the intended security boundary of the permission model and enables access to privileged local     services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue     affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network     permissions (`--allow-net`) are still in the experimental phase. (CVE-2026-21636)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is prior to 20.20.0, 22.22.0, 24.13.0, 24.13.0, 25.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, January 13, 2026 Security Releases advisory.

  - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the     expected write-permission checks, which means file metadata can be modified in read-only directories. This     behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs     (CVE-2025-55132)

  - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact. Impact: Thank you, to Nikita Skovoroda for reporting and fixing this     vulnerability. (CVE-2025-55131)

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system     compromise. Impact: Thank you, to natann for reporting this vulnerability and thank you RafaelGSS for     fixing it. (CVE-2025-55130)

  - A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by     triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process     crashes, enabling a remote denial of service. This primarily affects applications that do not attach     explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => {     socket.on('error', err => { console.log(err); }); }); JavaScriptCopy to clipboard Impact: Thank you, to     dantt for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-59465)

  - We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'),     the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22,     v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered     by deep recursion under specific conditions. This patch improves recoverability in one edge case, but it     does not remove the broader risk. Recovery from space exhaustion is unspecified, besteffort behavior and     is not a reliable basis for availability or security. In availabilitycritical paths where recursion depth     may be influenced by untrusted input, prefer input validation and designs that bound or avoid recursion     rather than depending on stack space exhaustion behavior or the lack of tailcall optimizations in the     runtime/engine. See this blog post for details. Impact: Thank you, to Andrew MacPherson (AndrewMohawk) for     identifying & aaron_vercel for reporting this vulnerability and thank you mcollina for fixing it.
    (CVE-2025-59466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
286807	Linux Distros Unpatched Vulnerability : CVE-2026-21636	Nessus	Misc.	Local	critical
282656	Node.js 20.x < 20.20.0 / 22.x < 22.22.0 / 24.x < 24.13.0 / 24.x < 24.13.0 / 25.x < 25.3.0 Multiple Vulnerabilities (Tuesday, January 13, 2026 Security Releases).	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-21636

critical

Tenable Plugins

critical

medium