Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.8
CVE-2025-55132: Node.js 20-25: Malicious File Timestamps Can Be Altered
CVE-2025-55132 · published 9 months ago
Summary
A bug in Node.js allows files in read-only directories to have their access and modification timestamps changed. This can make it harder to track activity and rely on log data. Affected users should update to a fixed version of Node.js to prevent this from happening.
What to do
- Update alpine nodejs to version 22.22.0-r0.
- Update alpine nodejs to version 24.13.0-r0.
- Update alpine nodejs to version 22.22.2-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | nodejs | node.js |
>= 20.0.0, < 20.20.0 >= 22.0.0, < 22.22.0 >= 24.0.0, < 24.13.0 >= 25.0.0, < 25.3.0 cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Alpine:v3.22 | alpine | nodejs |
< 22.22.0-r0 Fix: upgrade to 22.22.0-r0
|
| Alpine:v3.23 | alpine | nodejs |
< 24.13.0-r0 Fix: upgrade to 24.13.0-r0
|
| Alpine:v3.21 | alpine | nodejs |
< 22.22.2-r0 Fix: upgrade to 22.22.2-r0
|
Original advisory text
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()`...
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
References
- https://nodejs.org/en/blog/vulnerability/december-2025-security-releases Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2025-55132 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55132... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-55132 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.8
Low
Type
CWE-276Incorrect Default Permissions
Timeline
Published20 Jan 2026
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta