Skip to content
fr Sign in
2.8 Low

CVE-2025-55132 A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()`…

Description

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Affected products and versions

Product Affected versions Fixed in
Node 25.2.1 No fix stated
Node 24.12.0 No fix stated
Node 22.21.1 No fix stated
Node 20.19.6 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Node

The 129 CVEs of Node →
CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,… 4.8 Medium CVE-2026-106070 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after… 3.7 Low CVE-2026-106071 A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard… 3.6 Low CVE-2026-106072 A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when… 6.7 Medium
Track this CVE