CVE-2025-55130
Critical · 9.1CVSS
9.1
EPSS
1.7%
Published
Jan 20, 2026
CISA due date
—
The record
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | node | 20.0.0 | 20.20.0 |
| Bitnami | node-min | 20.0.0 | 20.20.0 |
| Chainguard | nodejs-20 | 0 | 20.20.0-r0 |
| Chainguard | nodejs-20-doc | 0 | 20.20.0-r0 |
| Chainguard | nodejs-22 | 0 | 22.22.0-r0 |
| Chainguard | nodejs-22-doc | 0 | 22.22.0-r0 |
| Chainguard | nodejs-24 | 0 | 24.13.0-r0 |
| Chainguard | nodejs-24-doc | 0 | 24.13.0-r0 |
| Chainguard | nodejs-25 | 0 | 25.3.0-r0 |
| Mageia:9 | nodejs | 0 | 22.22.0-1.mga9 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | nodejs20 | 0 | 20.20.0-150600.3.15.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | nodejs22 | 0 | 22.22.0-150600.13.12.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | nodejs20 | 0 | 20.20.0-150600.3.15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | nodejs22 | 0 | 22.22.0-150600.13.12.1 |
| Wolfi | nodejs-20 | 0 | 20.20.0-r0 |
| Wolfi | nodejs-20-doc | 0 | 20.20.0-r0 |
| Wolfi | nodejs-22 | 0 | 22.22.0-r0 |
| Wolfi | nodejs-22-doc | 0 | 22.22.0-r0 |
| Wolfi | nodejs-24 | 0 | 24.13.0-r0 |
| Wolfi | nodejs-24-doc | 0 | 24.13.0-r0 |
| Wolfi | nodejs-25 | 0 | 25.3.0-r0 |
| openSUSE:Leap 15.6 | nodejs20 | 0 | 20.20.0-150600.3.15.1 |
| openSUSE:Leap 15.6 | nodejs22 | 0 | 22.22.0-150600.13.12.1 |
| openSUSE:Leap 16.0 | nodejs22 | 0 | 22.22.0-160000.1.1 |
| openSUSE:Tumbleweed | nodejs22 | 0 | 22.22.0-1.1 |
| openSUSE:Tumbleweed | nodejs24 | 0 | 24.13.0-1.1 |
| openSUSE:Tumbleweed | nodejs26 | 0 | 26.3.1-1.1 |
Related vulnerabilities
- CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js… Also affects node
- CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size… Also affects node
- CVE-2025-55132 A flaw in Node.js's permission model allows a file's access and modification timestamps… Also affects node
- CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate… Also affects node
- CVE-2025-55131 A flaw in Node.js's buffer allocation logic can expose uninitialized memory when… Also affects node
- HSEC-2024-0003 process: command injection via argument list on Windows Also affects node
- CVE-2025-27210 An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically… Also affects node
- CVE-2025-23085 A memory leak could occur when a remote peer abruptly closes the socket without sending a… Also affects node