Vulnerability · Published Jan 20, 2026 · Assigned by hackerone
CVE-2025-55131
High 7.1
In plain English
A high-severity buffer overflow in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)3.5%top 10.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:8 | nodejs-devel | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-devel | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-devel | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-devel | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-devel | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:10 | nodejs-docs | 1:22.22.0-3.el10_1 | ALSA-2026:1843 |
| AlmaLinux:8 | nodejs-docs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-docs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-docs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-docs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-docs | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:8 | nodejs-full-i18n | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs-full-i18n | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-full-i18n | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | nodejs-libs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-libs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-libs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-libs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:2422 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+4006+3c416519 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.3-1.module_el8.10.0+4061+f8ceeab9 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.6.0+172+f0ba00ec | ALSA-2026:2782 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-5.module_el8.10.0+4085+6f807d30 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-5.module_el8.10.0+4084+7c0af990 | ALSA-2026:2422 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-5.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-5.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-5.module_el8.10.0+4085+6f807d30 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-5.module_el8.10.0+4084+7c0af990 | ALSA-2026:2422 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-5.module_el9.7.0+196+ac40ca3b | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-5.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:10 | nodejs24-docs | 1:24.13.0-1.el10_1 | ALSA-2026:1842 |
| AlmaLinux:10 | nodejs24-npm | 1:11.6.2-1.24.13.0.1.el10_1 | ALSA-2026:1842 |
| AlmaLinux:8 | npm | 1:10.9.4-1.22.22.0.1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | npm | 1:11.6.2-1.24.13.0.0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | npm | 1:11.6.2-1.24.13.0.1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | npm | 1:10.8.2-1.20.20.0.1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | npm | 1:10.9.4-1.22.22.0.1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.0.1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | v8-13.6-devel | 3:13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | v8-13.6-devel | 3:13.6.233.17-1.24.13.0.1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| Alpine:v3.21 | nodejs | 22.22.2-r0 | ALPINE-CVE-2025-55131 |
| Alpine:v3.22 | nodejs | 22.22.0-r0 | ALPINE-CVE-2025-55131 |
| Alpine:v3.23 | nodejs | 24.13.0-r0 | ALPINE-CVE-2025-55131 |
| Alpine:v3.24 | nodejs | 24.13.0-r0 | ALPINE-CVE-2025-55131 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u2 | DEBIAN-CVE-2025-55131 |
| Debian:13 | nodejs | 20.19.2+dfsg-1+deb13u1 | DSA-6166-1 |
| Debian:13 | nodejs | 20.19.2+dfsg-1+deb13u1 | DEBIAN-CVE-2025-55131 |
| Debian:14 | nodejs | 22.22.0+dfsg+~cs22.19.6-1 | DEBIAN-CVE-2025-55131 |
| Rocky Linux:8 | nodejs | 1:20.20.0-1.module+el8.10.0+40077+29236b21 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs | 1:24.13.0-0.module+el8.10.0+40079+1d83e08b | RLSA-2026:2420 |
| Rocky Linux:8 | nodejs | 1:22.22.0-1.module+el8.10.0+40078+280dc7ce | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+2084+ab509703 | RLSA-2026:2420 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:2421 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 | RLSA-2026:2781 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:2783 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:2420 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40050+22a42328 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40051+f2ef3f49 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40050+22a42328 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40051+f2ef3f49 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:2781 |
| Rocky Linux:10 | nodejs22 | 1:22.22.0-3.el10_1 | RLSA-2026:1843 |
| Rocky Linux:10 | nodejs24 | 1:24.13.0-1.el10_1 | RLSA-2026:1842 |
| Ubuntu:24.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-55131 |
| Ubuntu:25.10 | nodejs | no fix listed | UBUNTU-CVE-2025-55131 |
| Ubuntu:26.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-55131 |
Affected products (as reported)
Weakness: CWE-120, CWE-497 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
References
- https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
- https://access.redhat.com/security/cve/CVE-2025-55131 vdb-entry, x_refsource_REDHAT
- RHBZ#2431350 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55131.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:2899 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1843 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1842 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2422 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2421 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2420 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2768 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2767 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2864 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2783 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2782 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2781 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7386 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7387 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6402 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6431 vendor-advisory, x_refsource_REDHAT