CVE-2025-55131
High · 7.1CVSS
7.1
EPSS
3.5%
Published
Jan 20, 2026
CISA due date
—
The record
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | node | 0 | 20.20.0 |
| Bitnami | node-min | 0 | 20.20.0 |
| Chainguard | nodejs-16 | 0 | 16.20.2-r16 |
| Chainguard | nodejs-20 | 0 | 20.20.0-r0 |
| Chainguard | nodejs-20-doc | 0 | 20.20.0-r0 |
| Chainguard | nodejs-22 | 0 | 22.22.0-r0 |
| Chainguard | nodejs-22-doc | 0 | 22.22.0-r0 |
| Chainguard | nodejs-24 | 0 | 24.13.0-r0 |
| Chainguard | nodejs-24-doc | 0 | 24.13.0-r0 |
| Chainguard | nodejs-25 | 0 | 25.3.0-r0 |
| Mageia:9 | nodejs | 0 | 22.22.0-1.mga9 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | nodejs20 | 0 | 20.20.0-150600.3.15.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | nodejs22 | 0 | 22.22.0-150600.13.12.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | nodejs20 | 0 | 20.20.0-150600.3.15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | nodejs22 | 0 | 22.22.0-150600.13.12.1 |
| Wolfi | nodejs-16 | 0 | 16.20.2-r16 |
| Wolfi | nodejs-20 | 0 | 20.20.0-r0 |
| Wolfi | nodejs-20-doc | 0 | 20.20.0-r0 |
| Wolfi | nodejs-22 | 0 | 22.22.0-r0 |
| Wolfi | nodejs-22-doc | 0 | 22.22.0-r0 |
| Wolfi | nodejs-24 | 0 | 24.13.0-r0 |
| Wolfi | nodejs-24-doc | 0 | 24.13.0-r0 |
| Wolfi | nodejs-25 | 0 | 25.3.0-r0 |
| openSUSE:Leap 15.6 | nodejs20 | 0 | 20.20.0-150600.3.15.1 |
| openSUSE:Leap 15.6 | nodejs22 | 0 | 22.22.0-150600.13.12.1 |
| openSUSE:Leap 16.0 | nodejs22 | 0 | 22.22.0-160000.1.1 |
| openSUSE:Tumbleweed | nodejs22 | 0 | 22.22.0-1.1 |
| openSUSE:Tumbleweed | nodejs24 | 0 | 24.13.0-1.1 |
| openSUSE:Tumbleweed | nodejs26 | 0 | 26.3.1-1.1 |
Related vulnerabilities
- CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js… Also affects node
- CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size… Also affects node
- CVE-2025-55132 A flaw in Node.js's permission model allows a file's access and modification timestamps… Also affects node
- CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate… Also affects node
- CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and… Also affects node
- HSEC-2024-0003 process: command injection via argument list on Windows Also affects node
- CVE-2025-27210 An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically… Also affects node
- CVE-2025-23085 A memory leak could occur when a remote peer abruptly closes the socket without sending a… Also affects node