BIT-node-min-2025-55130

BIT-node-min-2025-55130 PUBLISHED CVSS 9.100000381469727 CRITICAL

Record from OSV · Published January 26, 2026

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
node-min	Bitnami	25.3.0, 24.13.0, 22.22.0, 20.20.0

Risk scores

CVSS 3.1

9.100000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Vendor	Product	Versions
Bitnami	node-min	20.0.0, 23.0.0, 25.0.0

Timeline

Jan 26, 2026 CVE Published
Jul 6, 2026 CVE Updated
Aug 8, 2026 Distribution Patch (16 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln BIT-node-min-2025-55130
vulnetix vdb fixes BIT-node-min-2025-55130

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/BIT-node-min-2025-55130/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 1 more

Look up in the Resolve Platform →