Vulnerability · Published Jan 20, 2026 · Assigned by hackerone
CVE-2025-55132
Low 2.8
In plain English
A low-severity incorrect default permissions in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)2.8Low
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | nodejs-devel | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-devel | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-devel | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-devel | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-devel | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:10 | nodejs-docs | 1:22.22.0-3.el10_1 | ALSA-2026:1843 |
| AlmaLinux:8 | nodejs-docs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs-docs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs-docs | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-docs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-docs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-full-i18n | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-full-i18n | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-full-i18n | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | nodejs-libs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs-libs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs-libs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-libs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:2422 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+4006+3c416519 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.3-1.module_el8.10.0+4061+f8ceeab9 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.6.0+172+f0ba00ec | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:2783 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-5.module_el8.10.0+4085+6f807d30 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-5.module_el8.10.0+4084+7c0af990 | ALSA-2026:2422 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-5.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-5.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-5.module_el8.10.0+4084+7c0af990 | ALSA-2026:2422 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-5.module_el8.10.0+4085+6f807d30 | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-5.module_el9.7.0+196+ac40ca3b | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-5.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:10 | nodejs24-docs | 1:24.13.0-1.el10_1 | ALSA-2026:1842 |
| AlmaLinux:10 | nodejs24-npm | 1:11.6.2-1.24.13.0.1.el10_1 | ALSA-2026:1842 |
| AlmaLinux:8 | npm | 1:11.6.2-1.24.13.0.0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | npm | 1:10.9.4-1.22.22.0.1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | npm | 1:10.9.4-1.22.22.0.1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | npm | 1:10.8.2-1.20.20.0.1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | npm | 1:11.6.2-1.24.13.0.1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.0.1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | v8-13.6-devel | 3:13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | v8-13.6-devel | 3:13.6.233.17-1.24.13.0.1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| Alpine:v3.21 | nodejs | 22.22.2-r0 | ALPINE-CVE-2025-55132 |
| Alpine:v3.22 | nodejs | 22.22.0-r0 | ALPINE-CVE-2025-55132 |
| Alpine:v3.23 | nodejs | 24.13.0-r0 | ALPINE-CVE-2025-55132 |
| Alpine:v3.24 | nodejs | 24.13.0-r0 | ALPINE-CVE-2025-55132 |
| Debian:13 | nodejs | 20.19.2+dfsg-1+deb13u1 | DSA-6166-1 |
| Debian:13 | nodejs | 20.19.2+dfsg-1+deb13u1 | DEBIAN-CVE-2025-55132 |
| Debian:14 | nodejs | 22.22.0+dfsg+~cs22.19.6-1 | DEBIAN-CVE-2025-55132 |
| Rocky Linux:8 | nodejs | 1:22.22.0-1.module+el8.10.0+40078+280dc7ce | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs | 1:24.13.0-0.module+el8.10.0+40079+1d83e08b | RLSA-2026:2420 |
| Rocky Linux:8 | nodejs | 1:20.20.0-1.module+el8.10.0+40077+29236b21 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+2084+ab509703 | RLSA-2026:2420 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:2422 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 | RLSA-2026:2781 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:2783 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:2420 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40051+f2ef3f49 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40050+22a42328 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40051+f2ef3f49 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40050+22a42328 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:2781 |
| Rocky Linux:10 | nodejs22 | 1:22.22.0-3.el10_1 | RLSA-2026:1843 |
| Rocky Linux:10 | nodejs24 | 1:24.13.0-1.el10_1 | RLSA-2026:1842 |
| Ubuntu:24.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-55132 |
| Ubuntu:25.10 | nodejs | no fix listed | UBUNTU-CVE-2025-55132 |
| Ubuntu:26.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-55132 |
Affected products (as reported)
Weakness: CWE-276 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N