CVE-2025-55132

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55130)

Node.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:

1. CVE-2025-55131 (High): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted using the vm module with the timeout option. Buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.
2. CVE-2025-55130 (High): A flaw in Node.js's Permissions model allows attackers to bypass `
3. CVE-2025-59465 (High): A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.
4. CVE-2025-59466 (Medium): A bug in Node.js error handling makes "Maximum call stack size exceeded" errors uncatchable when async_hooks.createHook() is enabled, causing the process to terminate unrecoverably.
5. CVE-2025-59464 (Medium): A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during socket.getPeerCertificate(true), allowing remote memory exhaustion.
6. CVE-2026-21636 (Medium): A flaw in Node.js's permission model allows Unix Domain Socket connections to bypass network restrictions even without `
7. CVE-2026-21637 (Medium): A flaw in Node.js TLS error handling allows synchronous exceptions thrown during pskCallback or ALPNCallback to bypass standard error handlers, causing process termination or file descriptor leaks.
8. CVE-2025-55132 (Low): A flaw in Node.js's permission model allows file timestamps to be changed via fs.futimes() even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55132)

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:

server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
```(CVE-2025-59465)

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded"…

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55130)

Node.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:

1. CVE-2025-55131 (High): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted using the vm module with the timeout option. Buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.
2. CVE-2025-55130 (High): A flaw in Node.js's Permissions model allows attackers to bypass `
3. CVE-2025-59465 (High): A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.
4. CVE-2025-59466 (Medium): A bug in Node.js error handling makes "Maximum call stack size exceeded" errors uncatchable when async_hooks.createHook() is enabled, causing the process to terminate unrecoverably.
5. CVE-2025-59464 (Medium): A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during socket.getPeerCertificate(true), allowing remote memory exhaustion.
6. CVE-2026-21636 (Medium): A flaw in Node.js's permission model allows Unix Domain Socket connections to bypass network restrictions even without `
7. CVE-2026-21637 (Medium): A flaw in Node.js TLS error handling allows synchronous exceptions thrown during pskCallback or ALPNCallback to bypass standard error handlers, causing process termination or file descriptor leaks.
8. CVE-2025-55132 (Low): A flaw in Node.js's permission model allows file timestamps to be changed via fs.futimes() even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55132)

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:

server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
```(CVE-2025-59465)

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded"…

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55130)

Node.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:

1. CVE-2025-55131 (High): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted using the vm module with the timeout option. Buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.
2. CVE-2025-55130 (High): A flaw in Node.js's Permissions model allows attackers to bypass `
3. CVE-2025-59465 (High): A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.
4. CVE-2025-59466 (Medium): A bug in Node.js error handling makes "Maximum call stack size exceeded" errors uncatchable when async_hooks.createHook() is enabled, causing the process to terminate unrecoverably.
5. CVE-2025-59464 (Medium): A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during socket.getPeerCertificate(true), allowing remote memory exhaustion.
6. CVE-2026-21636 (Medium): A flaw in Node.js's permission model allows Unix Domain Socket connections to bypass network restrictions even without `
7. CVE-2026-21637 (Medium): A flaw in Node.js TLS error handling allows synchronous exceptions thrown during pskCallback or ALPNCallback to bypass standard error handlers, causing process termination or file descriptor leaks.
8. CVE-2025-55132 (Low): A flaw in Node.js's permission model allows file timestamps to be changed via fs.futimes() even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55132)

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:

server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
```(CVE-2025-59465)

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded"…

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55130)

Node.js has released security updates addressing multiple vulnerabilities affecting its active release lines (20.x, 22.x, 24.x, 25.x). Key issues include:

1. CVE-2025-55131 (High): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted using the vm module with the timeout option. Buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data, potentially leaking in-process secrets (tokens, passwords) or causing data corruption.
2. CVE-2025-55130 (High): A flaw in Node.js's Permissions model allows attackers to bypass `
3. CVE-2025-59465 (High): A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket error, leading to a remote denial of service.
4. CVE-2025-59466 (Medium): A bug in Node.js error handling makes "Maximum call stack size exceeded" errors uncatchable when async_hooks.createHook() is enabled, causing the process to terminate unrecoverably.
5. CVE-2025-59464 (Medium): A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during socket.getPeerCertificate(true), allowing remote memory exhaustion.
6. CVE-2026-21636 (Medium): A flaw in Node.js's permission model allows Unix Domain Socket connections to bypass network restrictions even without `
7. CVE-2026-21637 (Medium): A flaw in Node.js TLS error handling allows synchronous exceptions thrown during pskCallback or ALPNCallback to bypass standard error handlers, causing process termination or file descriptor leaks.
8. CVE-2025-55132 (Low): A flaw in Node.js's permission model allows file timestamps to be changed via fs.futimes() even with only read permissions, potentially obscuring activity in logs.(CVE-2025-55131)

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.(CVE-2025-55132)

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:

server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
```(CVE-2025-59465)

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded"…

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

• nodejs: Nodejs denial of service (CVE-2026-21637)

• nodejs: Nodejs denial of service (CVE-2025-59466)

• nodejs: Nodejs denial of service (CVE-2025-59465)

• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
• nodejs: Nodejs denial of service (CVE-2026-21637)
• nodejs: Nodejs denial of service (CVE-2025-59466)
• nodejs: Nodejs denial of service (CVE-2025-59465)
• nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
• nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame. (CVE-2025-59465) Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers. (CVE-2025-59466) Bypass File System Permissions using crafted symlinks. (CVE-2025-55130) Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled. (CVE-2025-55131) fs.futimes() Bypasses Read-Only Permission Model. (CVE-2025-55132) TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak. (CVE-2026-21637)

These are all security issues fixed in the corepack24-24.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack22-22.22.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs22 fixes the following issues:

Update to 22.22.0:

• CVE-2025-55130: file system permissions bypass via crafted symlinks (bsc#1256569).
• CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
• CVE-2025-55132: a file's access and modification timestamps can be changed via futimes() even when the process has only read permissions (bsc#1256571).
• CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
• CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).

For full changelog, please see https://nodejs.org/en/blog

This update for nodejs22 fixes the following issues:

Security fixes:

• CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading to resource exhaustion (bsc#1256848)
• CVE-2026-21637: Fixed synchronous exceptions thrown during callbacks that bypass TLS error handling and causing denial of service (bsc#1256576)
• CVE-2025-55132: Fixed futimes() ability to acces file even if process has read permissions only (bsc#1256571)
• CVE-2025-55131: Fixed race condition that allowed allocations with leftover data leading to in-process secrets exposure (bsc#1256570)
• CVE-2025-55130: Fixed filesystem permissions bypass via crafted symlinks (bsc#1256569)
• CVE-2025-59465: Fixed malformed HTTP/2 HEADERS frame with invalid HPACK leading to crash (bsc#1256573)
• CVE-2025-59466: Fixed uncatchable 'Maximum call stack size exceeded' error leading to crash (bsc#1256574)

Other fixes:

• Update to 22.22.0:

  • deps: updated undici to 6.23.0
  • deps: updated bundled c-ares to 1.34.6 (if used)
  • add TLSSocket default error handler
  • disable futimes when permission model is enabled
  • require full read and write to symlink APIs
  • rethrow stack overflow exceptions in async_hooks
  • refactor unsafe buffer creation to remove zero-fill toggle
  • route callback exceptions through error handlers

• Update to 22.21.1:

  • src: avoid unnecessary string -> char* -> string round trips
  • src: remove unnecessary shadowed functions on Utf8Value & BufferValue
  • process: fix hrtime fast call signatures
  • http: improve writeEarlyHints by avoiding for-of loop

• Update to 22.21.0:

  • cli: add --use-env-proxy
  • http: support http proxy for fetch under NODE_USE_ENV_PROXY
  • http: add shouldUpgradeCallback to let servers control HTTP upgrades
  • http,https: add built-in proxy support in http/https.request and Agent
  • src: add percentage support to --max-old-space-size

• Update to 22.20.0

  • doc: stabilize --disable-sigusr1
  • doc: mark path.matchesGlob as stable
  • http: add Agent.agentKeepAliveTimeoutBuffer option
  • http2: add support for raw header arrays in h2Stream.respond()
  • inspector: add http2 tracking support
  • sea: implement execArgvExtension
  • sea: support execArgv in sea config
  • stream: add brotli support to CompressionStream and DecompressionStream
  • test_runner: support object property mocking
  • worker: add cpu profile APIs for worker

• Update to 22.19.0

  • cli: add NODE_USE_SYSTEM_CA=1
  • cli: support ${pid} placeholder in --cpu-prof-name
  • crypto: add tls.setDefaultCACertificates()
  • dns: support max timeout
  • doc: update the instruction on how to verify releases
  • esm: unflag --experimental-wasm-modules
  • http: add server.keepAliveTimeoutBuffer option
  • lib: docs deprecate http*
  • net: update net.blocklist to allow file save and file management
  • process: add threadCpuUsage
  • zlib: add dictionary support to zstdCompress and zstdDecompress

• Update to 22.18.0:

  • deps: update amaro to 1.1.0
  • doc: add all watch-mode related flags to node.1
  • doc: add islandryu to collaborators
  • esm: implement import.meta.main
  • fs: allow correct handling of burst in fs-events with AsyncIterator
  • permission: propagate permission model flags on spawn
  • sqlite: add support for readBigInts option in db connection level
  • src,permission: add support to permission.has(addon)
  • url: add fileURLToPathBuffer API
  • watch: add --watch-kill-signal flag
  • worker: make Worker async disposable

This update for nodejs22 fixes the following issues:

Security fixes:

• CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading to resource exhaustion (bsc#1256848)
• CVE-2026-21637: Fixed synchronous exceptions thrown during callbacks that bypass TLS error handling and causing denial of service (bsc#1256576)
• CVE-2025-55132: Fixed futimes() ability to acces file even if process has read permissions only (bsc#1256571)
• CVE-2025-55131: Fixed race condition that allowed allocations with leftover data leading to in-process secrets exposure (bsc#1256570)
• CVE-2025-55130: Fixed filesystem permissions bypass via crafted symlinks (bsc#1256569)
• CVE-2025-59465: Fixed malformed HTTP/2 HEADERS frame with invalid HPACK leading to crash (bsc#1256573)
• CVE-2025-59466: Fixed uncatchable 'Maximum call stack size exceeded' error leading to crash (bsc#1256574)

Other fixes:

• Update to 22.22.0:

  • deps: updated undici to 6.23.0
  • deps: updated bundled c-ares to 1.34.6 (if used)
  • add TLSSocket default error handler
  • disable futimes when permission model is enabled
  • require full read and write to symlink APIs
  • rethrow stack overflow exceptions in async_hooks
  • refactor unsafe buffer creation to remove zero-fill toggle
  • route callback exceptions through error handlers

• Update to 22.21.1:

  • src: avoid unnecessary string -> char* -> string round trips
  • src: remove unnecessary shadowed functions on Utf8Value & BufferValue
  • process: fix hrtime fast call signatures
  • http: improve writeEarlyHints by avoiding for-of loop

• Update to 22.21.0:

  • cli: add --use-env-proxy
  • http: support http proxy for fetch under NODE_USE_ENV_PROXY
  • http: add shouldUpgradeCallback to let servers control HTTP upgrades
  • http,https: add built-in proxy support in http/https.request and Agent
  • src: add percentage support to --max-old-space-size

• Update to 22.20.0

  • doc: stabilize --disable-sigusr1
  • doc: mark path.matchesGlob as stable
  • http: add Agent.agentKeepAliveTimeoutBuffer option
  • http2: add support for raw header arrays in h2Stream.respond()
  • inspector: add http2 tracking support
  • sea: implement execArgvExtension
  • sea: support execArgv in sea config
  • stream: add brotli support to CompressionStream and DecompressionStream
  • test_runner: support object property mocking
  • worker: add cpu profile APIs for worker

• Update to 22.19.0

  • cli: add NODE_USE_SYSTEM_CA=1
  • cli: support ${pid} placeholder in --cpu-prof-name
  • crypto: add tls.setDefaultCACertificates()
  • dns: support max timeout
  • doc: update the instruction on how to verify releases
  • esm: unflag --experimental-wasm-modules
  • http: add server.keepAliveTimeoutBuffer option
  • lib: docs deprecate http*
  • net: update net.blocklist to allow file save and file management
  • process: add threadCpuUsage
  • zlib: add dictionary support to zstdCompress and zstdDecompress

• Update to 22.18.0:

  • deps: update amaro to 1.1.0
  • doc: add all watch-mode related flags to node.1
  • doc: add islandryu to collaborators
  • esm: implement import.meta.main
  • fs: allow correct handling of burst in fs-events with AsyncIterator
  • permission: propagate permission model flags on spawn
  • sqlite: add support for readBigInts option in db connection level
  • src,permission: add support to permission.has(addon)
  • url: add fileURLToPathBuffer API
  • watch: add --watch-kill-signal flag
  • worker: make Worker async disposable