nodejs
diff --git a/‎src/pipe_wrap.cc‎
Lines changed: 5 additions & 1 deletion b/‎src/pipe_wrap.cc‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎test/parallel/test-permission-net-uds.js‎
Lines changed: 18 additions & 0 deletions b/‎test/parallel/test-permission-net-uds.js‎
Lines changed: 18 additions & 0 deletions
@@ -162,7 +162,10 @@ PipeWrap::PipeWrap(Environment* env,
 void PipeWrap::Bind(const FunctionCallbackInfo<Value>& args) {
   PipeWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
-  node::Utf8Value name(args.GetIsolate(), args[0]);
+  Environment* env = wrap->env();
+  node::Utf8Value name(env->isolate(), args[0]);
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNet, name.ToStringView());
   int err =
       uv_pipe_bind2(&wrap->handle_, *name, name.length(), UV_PIPE_NO_TRUNCATE);
   args.GetReturnValue().Set(err);
@@ -193,6 +196,7 @@ void PipeWrap::Listen(const FunctionCallbackInfo<Value>& args) {
   Environment* env = wrap->env();
   int backlog;
   if (!args[0]->Int32Value(env->context()).To(&backlog)) return;
+  THROW_IF_INSUFFICIENT_PERMISSIONS(env, permission::PermissionScope::kNet, "");
   int err = uv_listen(
       reinterpret_cast<uv_stream_t*>(&wrap->handle_), backlog, OnConnection);
   args.GetReturnValue().Set(err);
 
@@ -29,3 +29,21 @@ const tls = require('tls');
 
   client.on('connect', common.mustNotCall('TCP connection should be blocked'));
 }
+
+{
+  assert.throws(() => {
+    net.createServer().listen('/tmp/perm-server.sock');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'Net',
+  });
+}
+
+{
+  assert.throws(() => {
+    tls.createServer().listen('/tmp/perm-tls-server.sock');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'Net',
+  });
+}