Skip to content
fr Sign in
7.1 High

CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions…

Description

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Affected products and versions

Product Affected versions Fixed in
Node 25.2.1 No fix stated
Node 24.12.0 No fix stated
Node 22.21.1 No fix stated
Node 20.19.6 No fix stated
Red Hat Enterprise Linux AppStream EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 8) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.4) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.6) Versions not published
Show the 8 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat Hardened Images 22.22 earliest → < 22.22.0-1.3.hum1 22.22.0-1.3.hum1
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 8 8100020260119100525.489197 earliest → < 8100020260119100525.489197e6 8100020260119100525.489197e6
Red Hat Enterprise Linux 9 9070020260117213748 earliest → < 9070020260117213748.rhel9 9070020260117213748.rhel9
Red Hat Enterprise Linux 9.4 Extended Update Support 9040020260211171433 earliest → < 9040020260211171433.rhel9 9040020260211171433.rhel9
Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260210120402 earliest → < 9060020260210120402.rhel9 9060020260210120402.rhel9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Node

The 129 CVEs of Node →
CVE-2026-106069 A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP… 7.4 High CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,… 4.8 Medium CVE-2026-105482 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()… 7.4 High CVE-2026-106070 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after… 3.7 Low
Track this CVE