.webp?w=1920&resize=1920,0&ssl=1 "Node.js Security Release Fixes 7 Vulnerabilities")
The Node.js project has released critical security updates addressing multiple vulnerabilities affecting all active release lines.
On January 13, 2026, the Node.js team announced patches for versions 20.x, 22.x, 24.x, and 25.x, tackling three high-severity issues, four medium-severity issues, and one low-severity vulnerability.
These updates include dependency patches for c-ares and undici, resolving public vulnerabilities that could enable remote exploitation.
The most critical vulnerability, CVE-2025-55131, involves timeout-based race conditions in buffer allocation logic.
| CVE ID | Vulnerability Title | Severity | Affected Versions |
|---|---|---|---|
| CVE-2025-55131 | Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled | High | 20.x, 22.x, 24.x, 25.x |
| CVE-2025-55130 | Bypass File System Permissions using crafted symlinks | High | 20.x, 22.x, 24.x, 25.x |
| CVE-2025-59465 | Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame | High | 20.x, 22.x, 24.x, 25.x |
| CVE-2025-59466 | Uncatchable “Maximum call stack size exceeded” error via async_hooks leads to process crashes | Medium | 20.x, 22.x, 24.x, 25.x |
| CVE-2025-59464 | Memory leak that enables remote Denial of Service against TLS client certificate processing | Medium | 20.x, 22.x, 24.x |
| CVE-2026-21636 | Permission model bypass via unchecked Unix Domain Socket connections | Medium | 25.x |
| CVE-2026-21637 | TLS PSK/ALPN Callback Exceptions Bypass Error Handlers causing DoS and FD Leak | Medium | 20.x, 22.x, 24.x, 25.x |
| CVE-2025-55132 | fs.futimes() Bypasses Read-Only Permission Model | Low | 20.x, 22.x, 24.x, 25.x |
When using the vm module with timeouts, buffers allocated via Buffer.alloc and TypedArray instances like Uint8Array may contain uninitialized memory, exposing in-process secrets such as tokens or passwords.
While exploitation typically requires precise timing or in-process code execution, the vulnerability becomes remotely exploitable when untrusted input influences workload and timeouts.
A second high-severity flaw, CVE-2025-55130, allows attackers to bypass the –allow-fs-read and –allow-fs-write permission restrictions using crafted relative symlink paths.
This breaks the isolation guarantees of Node.js’s permission model, enabling arbitrary file access.
The third high-severity issue, CVE-2025-59465, affects HTTP/2 servers receiving malformed HEADERS frames with oversized HPACK data.
This vulnerability triggers unhandled TLSSocket errors causing process crashes, resulting in denial of service for applications lacking explicit socket error handlers.
Medium-severity vulnerabilities include a memory leak in TLS certificate processing (CVE-2025-59464), uncatchable stack overflow errors via async_hooks (CVE-2025-59466), and TLS callback exceptions bypassing error handlers (CVE-2026-21637).
A permission model bypass affecting Unix Domain Socket connections (CVE-2026-21636) impacts version 25.x specifically. The low-severity issue CVE-2025-55132 allows fs.futimes() to modify file timestamps despite read-only permissions.
Users operating Node.js in production environments should prioritize updating to patched versions immediately.
The Node.js security policy recommends using up-to-date versions from the active release schedule to maintain system security.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
.webp?fit=1600,900&ssl=1&description=The Node.js project has released critical security updates addressing multiple vulnerabilities affecting all active release lines.){kind=link}