VDB

CVE-2025-55131

CVE-2025-55131 PUBLISHED CVSS 7.1 HIGH

Reported by hackerone · Published January 20, 2026

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
nodejs-22Chainguard22.22.0-r0
nodejs22-npmAmazon Linux1:10.9.4-1.22.22.0.1.amzn2023.0.1
v8-13.6-develAmazon Linux3:13.6.233.17-1.24.13.0.1.amzn2023.0.1
nodejs-20Wolfi20.20.0-r0
nodejs20-develAmazon Linux1:20.20.0-1.amzn2023.0.1
nodejs24-full-i18nAmazon Linux1:24.13.0-1.amzn2023.0.1
nodejs22-full-i18nAmazon Linux1:22.22.0-1.amzn2023.0.1
nodejs24-docsAmazon Linux1:24.13.0-1.amzn2023.0.1
nodejs20-npmAmazon Linux1:10.8.2-1.20.20.0.1.amzn2023.0.1
nodejs20-libsAmazon Linux1:20.20.0-1.amzn2023.0.1
nodejs24Amazon Linux1:24.13.0-1.amzn2023.0.1
nodejs-22Wolfi22.22.0-r0

29 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.0
7.1
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected products

VendorProductVersions
nodejsnode20.19.6, 22.21.1, 24.12.0
chainguardnodejs-220
amazon:2023nodejs22-npm0
Red HatRed Hat Enterprise Linux 99070020260117213814.rhel9
Red HatRed Hat Enterprise Linux 88100020260119100525.489197e6
amazon:2023v8-13.6-devel0
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support9060020260210180816.rhel9
wolfinodejs-200
amazon:2023nodejs20-devel0
Red HatRed Hat Hardened Images20.20.0-7.1.hum1
amazon:2023nodejs24-full-i18n0
Red HatRed Hat Enterprise Linux AppStream EUS (v.9.4)
Red HatRed Hat Enterprise Linux AppStream (v. 9)
amazon:2023nodejs22-full-i18n0
amazon:2023nodejs24-docs0
amazon:2023nodejs20-npm0
amazon:2023nodejs20-libs0
amazon:2023nodejs240
Red HatRed Hat Enterprise Linux AppStream EUS (v.9.6)
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support9040020260211171433.rhel9

…and 35 more

Timeline

  • Jan 20, 2026 CVE Published
  • Jan 21, 2026 EPSS Score (30 in total, the first dated here)
  • Feb 12, 2026 PoC Published
  • Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
  • Jun 2, 2026 Security Advisory (24 in total, the first dated here)
  • Jul 1, 2026 Distribution Patch (20 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-55131
vulnetix vdb fixes CVE-2025-55131

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-55131/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›