- Description
- A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
- Source
- support@hackerone.com
- NVD status
- Analyzed
- Products
- node.js
CVSS 3.1
- Type
- Primary
- Base score
- 9.1
- Impact score
- 5.2
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity
- CRITICAL
CVSS 3.0
- Type
- Secondary
- Base score
- 7.1
- Impact score
- 5.2
- Exploitability score
- 1.8
- Vector string
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-289
- Hype score
- Not currently trending
#SUSE just patched Node.js 20 (CVE-2025-55130). The CVSS 7.5 is almost misleading—this isn't complex to execute. HTTP/2 continuation flood = CPU pegged at 100%. No auth needed. Just packets. Read more: 👉 https://t.co/EICUWjFMxX #Security https://t.co/WBMwf0QSeW
@Cezar_H_Linux
12 Feb 2026
41 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Vulnerabilidades en Node.js ❗ CVE-2025-59465 ❗ CVE-2025-55131 ❗ CVE-2025-55130 ➡️ Más info: https://t.co/f2f9WvQE7y https://t.co/4B6X02leVC
@CERTpy
20 Jan 2026
100 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes
kusanagi-nodejs22 Module Update 22.22.0-1 KUSANAGI 9 modules have been updated. The updated modules are as follows: nodejs 22.22.0-1 This update includes support for vulnerability(CVE-2025-59465, CVE-2025-55132, CVE-2025-55130, CVE-2025-59466,... https://t.co/Eq9v5q9WRi
@kusanagi_saya
20 Jan 2026
36 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
kusanagi-nodejs22 モジュール更新情報 22.22.0-1 KUSANAGI 9 を構成している各モジュールのアップデートを行いました。 アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 nodejs 22
@kusanagi_saya
20 Jan 2026
32 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Node.js January 13, 2026 Security Releases https://t.co/AJE4YZ4bd1 CVE-2025-55131 Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled CVE-2025-55130 Bypass filesystem permissions using symlinks CVE-2025-59465 HTTP/2 server crashes with unhandled error &
@oss_security
15 Jan 2026
1677 Impressions
3 Retweets
15 Likes
6 Bookmarks
0 Replies
0 Quotes
agent sandbox ppl gonna rip their hair out w/this one CVE-2025-55130 https://t.co/bjr2zrwpzs
@nanovms
13 Jan 2026
144 Impressions
1 Retweet
3 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"matchCriteriaId": "A78B4AE9-C1B4-4DD0-9EDF-A3A60431B6DA",
"versionEndExcluding": "20.20.0",
"versionStartIncluding": "20.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"matchCriteriaId": "132A7510-B3E9-4F85-9B61-A834B12DD7D7",
"versionEndExcluding": "22.22.0",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"matchCriteriaId": "A83233BD-D901-4A1A-A3AF-0DC3E76CD2C0",
"versionEndExcluding": "24.13.0",
"versionStartIncluding": "24.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"matchCriteriaId": "970EF154-D905-4FDA-85CB-C3AB08BEFAEC",
"versionEndExcluding": "25.3.0",
"versionStartIncluding": "25.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]