CVE-2025-55130: NodeJS Security leases (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, and others)
A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55130?
CVE-2025-55130 is considered a significant security vulnerability due to its potential to allow unauthorized access to file system resources.
How do I fix CVE-2025-55130?
To remediate CVE-2025-55130, upgrade Node.js to version 26.0.0 or later, where the flaw has been addressed.
Which versions of Node.js are affected by CVE-2025-55130?
CVE-2025-55130 affects Node.js versions from 20.0.0 to 26.0.0.
What are the risks associated with CVE-2025-55130?
The risks include the potential for attackers to bypass file system permission restrictions and access sensitive data.
Is CVE-2025-55130 part of a larger vulnerability series?
Yes, CVE-2025-55130 is part of a series of related vulnerabilities in Node.js's permissions model.