The short version
Some tool servers that agents use listen on every network interface and ask nothing of the caller. If one of yours does, anyone who can reach its port can use it.
You can find these on your own machines in a few minutes. You can close them in one line of code or one firewall rule. This note shows how.
Why the default matters
A server that starts listening without being told which address to use may take all of them. We checked one case on 2026-10-01 and again on 2026-10-02. On Node 22.17.1, listen(port) with no host reported the address ::, which is every interface. The same call with 127.0.0.1 reported loopback only.
That is one runtime and one version. Other runtimes differ. Check yours.
Step 1: list what is listening
On Linux:
ss -ltnp
On macOS:
lsof -nP -iTCP -sTCP:LISTEN
On Windows:
netstat -ano -p tcp | findstr LISTENING
Look at the local address column. 0.0.0.0:PORT and [::]:PORT mean all interfaces. 127.0.0.1:PORT means this machine only. On macOS, lsof shows all interfaces as *:PORT.
Write down every port that is not a service you chose to expose. Match each to a process.
Step 2: look from outside
From a second machine you own, try the port:
curl -i http://HOST:PORT/
Only test hosts you own or are allowed to test. If you get an answer with no login, the server is open to whoever can reach that network.
"Reach" is the whole question. A laptop on a shared network is reachable by its neighbours. A cloud instance is reachable by whatever its security group allows.
Step 3: bind to loopback
If the tool only needs to talk to a program on the same machine, say so in code. In Node:
server.listen(port, "127.0.0.1")
Look for a host option or an environment variable for this in your server's documentation. Set it. Then run Step 1 again and confirm the address changed.
Step 4: restrict where browsers may call from
A cross-origin setting that allows every origin tells the browser that any website may read the server's answers. Some browsers now ask the user before a public page can reach a local address. Do not count on that prompt. We did not test browser behavior for this note, so check it in your own setup.
Allow one named origin, or none. Do not use a wildcard on a server that can change state.
Step 5: put a lock on it
Binding to loopback is not a lock. Anything running as another user on the same machine can still reach it. Add one of these:
- a bearer token the server checks on every request
- a reverse proxy that requires a login or a client certificate
- a Unix socket with file permissions in place of a TCP port
- an SSH tunnel, when you need remote access
Pick the one that fits. Then try Step 2 again without the credential and confirm you are refused.
Step 6: close the port at the network edge
A host firewall rule that allows only the addresses you name is a second layer. It does not replace the steps above. It limits the damage when one of them is missed.
What this note does not show
We did not scan any third-party network. We tested one runtime default, on one machine. We did not run the macOS command for this note. We have not measured how many tool servers ship open, and we make no estimate. The steps are general practice, not the result of a study.
Sources: our own check of the Node listen default on 2026-10-01 and 2026-10-02. The remaining steps are standard administration and are not new findings.
Originally published at botzr.com.
Top comments (0)