Cloudanix VulnDB

CVE-2025-55132

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Jan 20, 2026

CISA due date

—

The record

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami node 20.0.0 20.20.0
Bitnami node-min 20.0.0 20.20.0
Chainguard nodejs-20 0 20.20.0-r0
Chainguard nodejs-20-doc 0 20.20.0-r0
Chainguard nodejs-22 0 22.22.0-r0
Chainguard nodejs-22-doc 0 22.22.0-r0
Chainguard nodejs-24 0 24.13.0-r0
Chainguard nodejs-24-doc 0 24.13.0-r0
Chainguard nodejs-25 0 25.3.0-r0
Mageia:9 nodejs 0 22.22.0-1.mga9
SUSE:Linux Enterprise Server 15 SP6-LTSS nodejs20 0 20.20.0-150600.3.15.1
SUSE:Linux Enterprise Server 15 SP6-LTSS nodejs22 0 22.22.0-150600.13.12.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 nodejs20 0 20.20.0-150600.3.15.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 nodejs22 0 22.22.0-150600.13.12.1
Wolfi nodejs-20 0 20.20.0-r0
Wolfi nodejs-20-doc 0 20.20.0-r0
Wolfi nodejs-22 0 22.22.0-r0
Wolfi nodejs-22-doc 0 22.22.0-r0
Wolfi nodejs-24 0 24.13.0-r0
Wolfi nodejs-24-doc 0 24.13.0-r0
Wolfi nodejs-25 0 25.3.0-r0
openSUSE:Leap 15.6 nodejs20 0 20.20.0-150600.3.15.1
openSUSE:Leap 15.6 nodejs22 0 22.22.0-150600.13.12.1
openSUSE:Leap 16.0 nodejs22 0 22.22.0-160000.1.1
openSUSE:Tumbleweed nodejs22 0 22.22.0-1.1
openSUSE:Tumbleweed nodejs24 0 24.13.0-1.1
openSUSE:Tumbleweed nodejs26 0 26.3.1-1.1

Related vulnerabilities