CVE-2025-55132: Medium severity npm/node vulnerability
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55132?
CVE-2025-55132 is classified as a medium severity vulnerability due to its potential for unauthorized modification of file metadata.
How do I fix CVE-2025-55132?
To mitigate CVE-2025-55132, update to the latest version of Node.js where the vulnerability is patched.
What impact does CVE-2025-55132 have on file management in Node.js?
CVE-2025-55132 allows unauthorized changes to file access and modification timestamps, potentially compromising file integrity.
Which versions of Node.js are affected by CVE-2025-55132?
CVE-2025-55132 affects multiple versions of Node.js prior to the security patches released in December 2025.
Is there a workaround for CVE-2025-55132 if I cannot update Node.js?
There is no official workaround for CVE-2025-55132, making updating to a patched version the best mitigation.