Medium severity5.3OSV Advisory· Published Jan 20, 2026· Updated Jun 17, 2026
CVE-2025-55132
CVE-2025-55132
Description
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
54- osv-coords51 versionspkg:apk/chainguard/nodejs-20pkg:apk/chainguard/nodejs-20-docpkg:apk/chainguard/nodejs-22pkg:apk/chainguard/nodejs-22-docpkg:apk/chainguard/nodejs-24pkg:apk/chainguard/nodejs-24-docpkg:apk/chainguard/nodejs-25pkg:apk/wolfi/nodejs-20pkg:apk/wolfi/nodejs-20-docpkg:apk/wolfi/nodejs-22pkg:apk/wolfi/nodejs-22-docpkg:apk/wolfi/nodejs-24pkg:apk/wolfi/nodejs-24-docpkg:apk/wolfi/nodejs-25pkg:bitnami/nodepkg:bitnami/node-minpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-develpkg:rpm/opensuse/nodejs20&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweedpkg:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/nodejs22&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 20.20.0-r0+ 50 more
- (no CPE)range: < 20.20.0-r0
- (no CPE)range: < 20.20.0-r0
- (no CPE)range: < 22.22.0-r0
- (no CPE)range: < 22.22.0-r0
- (no CPE)range: < 24.13.0-r0
- (no CPE)range: < 24.13.0-r0
- (no CPE)range: < 25.3.0-r0
- (no CPE)range: < 20.20.0-r0
- (no CPE)range: < 20.20.0-r0
- (no CPE)range: < 22.22.0-r0
- (no CPE)range: < 22.22.0-r0
- (no CPE)range: < 24.13.0-r0
- (no CPE)range: < 24.13.0-r0
- (no CPE)range: < 25.3.0-r0
- (no CPE)range: >= 20.0.0, < 20.20.0
- (no CPE)range: >= 20.0.0, < 20.20.0
- (no CPE)range: < 1:24.13.0-0.module_el8.10.0+4113+bc863bc2
- (no CPE)range: < 1:24.13.0-0.module_el8.10.0+4113+bc863bc2
- (no CPE)range: < 1:22.22.0-3.el10_1
- (no CPE)range: < 1:24.13.0-0.module_el8.10.0+4113+bc863bc2
- (no CPE)range: < 1:24.13.0-0.module_el8.10.0+4113+bc863bc2
- (no CPE)range: < 3.0.3-1.module_el8.10.0+4061+f8ceeab9
- (no CPE)range: < 1:10.9.4-1.22.22.0.3.el10_1
- (no CPE)range: < 2021.06-6.module_el8.10.0+4086+70facd4a
- (no CPE)range: < 2021.06-6.module_el8.10.0+4086+70facd4a
- (no CPE)range: < 1:24.13.0-1.el10_1
- (no CPE)range: < 1:24.13.0-1.el10_1
- (no CPE)range: < 1:24.13.0-1.el10_1
- (no CPE)range: < 1:24.13.0-1.el10_1
- (no CPE)range: < 1:24.13.0-1.el10_1
- (no CPE)range: < 1:11.6.2-1.24.13.0.1.el10_1
- (no CPE)range: < 1:11.6.2-1.24.13.0.0.module_el8.10.0+4113+bc863bc2
- (no CPE)range: < 3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b
- (no CPE)range: < 3:13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2
- (no CPE)range: < 20.20.0-150600.3.15.1
- (no CPE)range: < 22.22.0-150600.13.12.1
- (no CPE)range: < 22.22.0-160000.1.1
- (no CPE)range: < 22.22.0-1.1
- (no CPE)range: < 24.13.0-1.1
- (no CPE)range: < 26.3.1-1.1
- (no CPE)range: < 20.20.0-150500.11.24.1
- (no CPE)range: < 20.20.0-150500.11.24.1
- (no CPE)range: < 20.20.0-150500.11.24.1
- (no CPE)range: < 20.20.0-150600.3.15.1
- (no CPE)range: < 20.20.0-150500.11.24.1
- (no CPE)range: < 20.20.0-150600.3.15.1
- (no CPE)range: < 22.22.0-150700.3.6.1
- (no CPE)range: < 22.22.0-150600.13.12.1
- (no CPE)range: < 22.22.0-160000.1.1
- (no CPE)range: < 22.22.0-150600.13.12.1
- (no CPE)range: < 22.22.0-160000.1.1
Patches
Vulnerability mechanics
References
1- nodejs.org/en/blog/vulnerability/december-2025-security-releasesnvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.