CVE-2025-55131

Advisory lineage Upstream: 0 Downstream: 32
Deferred
Published: 20 Jan 2026, 20:41
Last modified:15 Jul 2026, 01:26

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
7.1 HIGH
v3.1 (cve.org)
EPSS Score
3.49% LOW
3% probability +3.46%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Jan 2026, 20:41
Published
Vulnerability first disclosed
15 Jul 2026, 01:26
Last Modified
Vulnerability information updated

Description

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.

CVSS Metrics

  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
  • v3.0•HIGH•Score: 7.1CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS Trends

Current EPSS score: 3.49%• Percentile: 88%

Techniques & Countermeasures

  • CWE-120•Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

    The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

  • CWE-497•Exposure of Sensitive System Information to an Unauthorized Control Sphere

    The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Affected Systems

  • nodejs•node

    20.19.6 | 22.21.1 | 24.12.0 | 25.2.1 | ≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.* | ≥ 17.0, < 17.* | ≥ 18.0, < 18.*

References (20)