ALPINE-CVE-2025-55130

ALPINE-CVE-2025-55130 PUBLISHED CVSS 9.100000381469727 CRITICAL

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Risk Scores

CVSS v3.1

9.100000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Alpine:v3.23	nodejs	0, 22.11.0-r0, 22.11.0-r1
Alpine:v3.21	nodejs	22.15.1-r0, 0, 22.11.0-r0
Alpine:v3.22	nodejs	0, 22.16.0-r1, 22.16.0-r2

Timeline

Jan 20, 2026 CVE Published
Apr 5, 2026 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2025-55130 advisory

Open in Interactive Console →