Node.js Security Release Fixes 7 Vulnerabilities Across All Supported Versions

The Node.js project has released critical security updates addressing multiple vulnerabilities affecting all active release lines.

On January 13, 2026, the Node.js team announced patches for versions 20.x, 22.x, 24.x, and 25.x, tackling three high-severity issues, four medium-severity issues, and one low-severity vulnerability.

These updates include dependency patches for c-ares and undici, resolving public vulnerabilities that could enable remote exploitation.

The most critical vulnerability, CVE-2025-55131, involves timeout-based race conditions in buffer allocation logic.

CVE ID	Vulnerability Title	Severity	Affected Versions
CVE-2025-55131	Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled	High	20.x, 22.x, 24.x, 25.x
CVE-2025-55130	Bypass File System Permissions using crafted symlinks	High	20.x, 22.x, 24.x, 25.x
CVE-2025-59465	Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame	High	20.x, 22.x, 24.x, 25.x
CVE-2025-59466	Uncatchable “Maximum call stack size exceeded” error via async_hooks leads to process crashes	Medium	20.x, 22.x, 24.x, 25.x
CVE-2025-59464	Memory leak that enables remote Denial of Service against TLS client certificate processing	Medium	20.x, 22.x, 24.x
CVE-2026-21636	Permission model bypass via unchecked Unix Domain Socket connections	Medium	25.x
CVE-2026-21637	TLS PSK/ALPN Callback Exceptions Bypass Error Handlers causing DoS and FD Leak	Medium	20.x, 22.x, 24.x, 25.x
CVE-2025-55132	fs.futimes() Bypasses Read-Only Permission Model	Low	20.x, 22.x, 24.x, 25.x

When using the vm module with timeouts, buffers allocated via Buffer.alloc and TypedArray instances like Uint8Array may contain uninitialized memory, exposing in-process secrets such as tokens or passwords.

While exploitation typically requires precise timing or in-process code execution, the vulnerability becomes remotely exploitable when untrusted input influences workload and timeouts.

A second high-severity flaw, CVE-2025-55130, allows attackers to bypass the –allow-fs-read and –allow-fs-write permission restrictions using crafted relative symlink paths.

This breaks the isolation guarantees of Node.js’s permission model, enabling arbitrary file access.

The third high-severity issue, CVE-2025-59465, affects HTTP/2 servers receiving malformed HEADERS frames with oversized HPACK data.

This vulnerability triggers unhandled TLSSocket errors causing process crashes, resulting in denial of service for applications lacking explicit socket error handlers.

Medium-severity vulnerabilities include a memory leak in TLS certificate processing (CVE-2025-59464), uncatchable stack overflow errors via async_hooks (CVE-2025-59466), and TLS callback exceptions bypassing error handlers (CVE-2026-21637).

A permission model bypass affecting Unix Domain Socket connections (CVE-2026-21636) impacts version 25.x specifically. The low-severity issue CVE-2025-55132 allows fs.futimes() to modify file timestamps despite read-only permissions.

Users operating Node.js in production environments should prioritize updating to patched versions immediately.

The Node.js security policy recommends using up-to-date versions from the active release schedule to maintain system security.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.