CVE-2025-55132
Last modified
CVE-2025-55132 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 20.0.0, < 20.20.0 |
| Nodejs | Node.Js | >= 22.0.0, < 22.22.0 |
| Nodejs | Node.Js | >= 24.0.0, < 24.13.0 |
| Nodejs | Node.Js | >= 25.0.0, < 25.3.0 |
References
- https://nodejs.org/en/blog/vulnerability/december-2025-security-releasesRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-55132?
How severe is CVE-2025-55132?
How do I fix CVE-2025-55132?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-55127HackerOne community member Dao Hoang Anh (yoyomiski) has rep…5.4
- CVE-2025-55128HackerOne community member Dang Hung Vi (vidang04) has repor…6.5
- CVE-2025-55129HackerOne community member Kassem S.(kassem_s94) has reporte…5.4
- CVE-2025-5513A vulnerability has been found in quequnlong shiyi-blog up t…5.4
- CVE-2025-55130A flaw in Node.js’s Permissions model allows attackers to by…9.1
- CVE-2025-55131A flaw in Node.js's buffer allocation logic can expose unini…7.1
- CVE-2025-55133In Agora Foundation Agora fall23-Alpha1 before b087490, ther…6.4
- CVE-2025-55134In Agora Foundation Agora fall23-Alpha1 before b087490, ther…6.4
- CVE-2025-55135In Agora Foundation Agora fall23-Alpha1 before 690ce56, ther…6.4
- CVE-2025-55136ERC (aka Emotion Recognition in Conversation) through 0.3 ha…5.7
- CVE-2025-55137LinkJoin through 882f196 mishandles lacks type checking in p…7.4
- CVE-2025-55138LinkJoin through 882f196 mishandles token ownership in passw…7.4
Are you affected by CVE-2025-55132?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST