Skip to content
OpenAdvisories
Low · 2.8 CVE-2025-55132 EUVD-2026-3325GHSA-pm9v-wcw9-xgpv

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process…

Published Jan 20, 2026 · Updated Jan 21, 2026 · Assigned by hackerone

Description

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Affected products

VendorProductAffectedFixed
nodejs node 20.19.6 – ≤ 20.19.6, 22.21.1 – ≤ 22.21.1, 24.12.0 – ≤ 24.12.0, 25.2.1 – ≤ 25.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 nodejs 22.22.0+dfsg+~cs22.19.6-1 —
Debian 13 nodejs 20.19.2+dfsg-1+deb13u1 DSA-6166-1
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS nodejs No fix yet —
Ubuntu 25.10 nodejs No fix yet —
Ubuntu 24.04 LTS nodejs No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS nodejs No fix yet —
Ubuntu Pro 20.04 LTS nodejs No fix yet —
Ubuntu Pro 18.04 LTS nodejs No fix yet —
Ubuntu Pro 16.04 LTS nodejs No fix yet —
Ubuntu Pro 14.04 LTS nodejs No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 nodejs +5 1:22.22.0-3.el10_1 RHSA-2026:1843
RHEL 10 nodejs-npm 1:10.9.4-1.22.22.0.3.el10_1 RHSA-2026:1843
RHEL 10 nodejs24 +4 1:24.13.0-1.el10_1 RHSA-2026:1842
RHEL 10 nodejs24-npm 1:11.6.2-1.24.13.0.1.el10_1 RHSA-2026:1842
RHEL 9 nodejs +3 1:20.20.0-1.module+el9.7.0+23895+0637d423 RHSA-2026:2783, RHSA-2026:2782, RHSA-2026:2781
RHEL 9 nodejs-libs 1:22.22.0-1.module+el9.7.0+23896+b5802de9 RHSA-2026:2782, RHSA-2026:2781
RHEL 9 nodejs-nodemon 3.0.1-1.module+el9.7.0+23895+0637d423 RHSA-2026:2783, RHSA-2026:2782, RHSA-2026:2781
RHEL 9 nodejs-packaging +1 2021.06-5.module+el9.7.0+23895+0637d423 RHSA-2026:2783, RHSA-2026:2782, RHSA-2026:2781
RHEL 9 npm 1:10.8.2-1.20.20.0.1.module+el9.7.0+23895+0637d423 RHSA-2026:2783, RHSA-2026:2782, RHSA-2026:2781
RHEL 9 v8-12.4-devel 3:12.4.254.21-1.22.22.0.1.module+el9.7.0+23896+b5802de9 RHSA-2026:2782
RHEL 9 v8-13.6-devel 3:13.6.233.17-1.24.13.0.1.module+el9.7.0+23894+c8377628 RHSA-2026:2781
RHEL 8 nodejs +3 1:20.20.0-1.module+el8.10.0+23905+c49b2aec RHSA-2026:2422, RHSA-2026:2421, RHSA-2026:2420
RHEL 8 nodejs-libs 1:22.22.0-1.module+el8.10.0+23904+2c92f862 RHSA-2026:2421, RHSA-2026:2420
RHEL 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+23474+222d264a RHSA-2026:2422, RHSA-2026:2421, RHSA-2026:2420
RHEL 8 nodejs-packaging +1 2021.06-5.module+el8.10.0+23590+1e59695e RHSA-2026:2422, RHSA-2026:2421, RHSA-2026:2420
RHEL 8 npm 1:10.8.2-1.20.20.0.1.module+el8.10.0+23905+c49b2aec RHSA-2026:2422, RHSA-2026:2421, RHSA-2026:2420
RHEL 8 v8-12.4-devel 3:12.4.254.21-1.22.22.0.1.module+el8.10.0+23904+2c92f862 RHSA-2026:2421
RHEL 8 v8-13.6-devel 3:13.6.233.17-1.24.13.0.0.module+el8.10.0+23888+24fa7806 RHSA-2026:2420
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 nodejs20 +6 20.20.0-7.1.hum1 RHSA-2026:7386
Red Hat Hardened Images 1 nodejs20-npm 10.8.2-1.20.20.0.7.1.hum1 RHSA-2026:7386
Red Hat Hardened Images 1 nodejs22 +6 22.22.0-1.3.hum1 RHSA-2026:7387
Red Hat Hardened Images 1 nodejs22-npm 10.9.4-1.22.22.0.1.3.hum1 RHSA-2026:7387
Red Hat Hardened Images 1 nodejs24 +6 24.14.1-4.hum1 RHSA-2026:7657, RHSA-2026:6402
Red Hat Hardened Images 1 nodejs24-npm 11.11.0-1.24.14.1.4.hum1 RHSA-2026:7657, RHSA-2026:6402
Red Hat Hardened Images 1 nodejs25 +6 25.9.0-1.hum1 RHSA-2026:7378, RHSA-2026:6431
Red Hat Hardened Images 1 nodejs25-npm 11.12.1-1.25.9.0.1.hum1 RHSA-2026:7378, RHSA-2026:6431

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 nodejs-docs 1:22.22.0-3.el10_1 ALSA-2026:1843
AlmaLinux 10 nodejs24-docs 1:24.13.0-1.el10_1 ALSA-2026:1842
AlmaLinux 10 nodejs24-npm 1:11.6.2-1.24.13.0.1.el10_1 ALSA-2026:1842
AlmaLinux 9 nodejs +3 1:20.20.0-1.module_el9.7.0+207+84573810 ALSA-2026:2783, ALSA-2026:2782, ALSA-2026:2781
AlmaLinux 9 nodejs-libs 1:22.22.0-1.module_el9.7.0+208+fb06c0ab ALSA-2026:2782, ALSA-2026:2781
AlmaLinux 9 nodejs-nodemon 3.0.1-1.module_el9.5.0+125+8dc38870 ALSA-2026:2783, ALSA-2026:2782, ALSA-2026:2781
AlmaLinux 9 nodejs-packaging 2021.06-5.module_el9.7.0+207+84573810 ALSA-2026:2783, ALSA-2026:2782, ALSA-2026:2781
AlmaLinux 9 nodejs-packaging-bundler 2021.06-5.module_el9.7.0+196+ac40ca3b ALSA-2026:2783, ALSA-2026:2782, ALSA-2026:2781
AlmaLinux 9 npm 1:10.8.2-1.20.20.0.1.module_el9.7.0+207+84573810 ALSA-2026:2783, ALSA-2026:2782, ALSA-2026:2781
AlmaLinux 9 v8-12.4-devel 3:12.4.254.21-1.22.22.0.1.module_el9.7.0+208+fb06c0ab ALSA-2026:2782
AlmaLinux 9 v8-13.6-devel 3:13.6.233.17-1.24.13.0.1.module_el9.7.0+209+ecf6523e ALSA-2026:2781
AlmaLinux 8 nodejs +4 1:22.22.0-1.module_el8.10.0+4112+db1af44b ALSA-2026:2421, ALSA-2026:2420
AlmaLinux 8 nodejs-nodemon 3.0.1-1.module_el8.10.0+3982+85c136aa ALSA-2026:2422, ALSA-2026:2421, ALSA-2026:2420
AlmaLinux 8 nodejs-packaging +1 2021.06-5.module_el8.10.0+4084+7c0af990 ALSA-2026:2422, ALSA-2026:2421, ALSA-2026:2420
AlmaLinux 8 npm 1:10.9.4-1.22.22.0.1.module_el8.10.0+4112+db1af44b ALSA-2026:2421, ALSA-2026:2420
AlmaLinux 8 v8-12.4-devel 3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b ALSA-2026:2421
AlmaLinux 8 v8-13.6-devel 3:13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2 ALSA-2026:2420

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 nodejs22 1:22.22.0-3.el10_1 RLSA-2026:1843
Rocky Linux 10 nodejs24 1:24.13.0-1.el10_1 RLSA-2026:1842
Rocky Linux 9 nodejs-nodemon 3.0.1-1.module+el9.7.0+40017+f0db1785 RLSA-2026:2783, RLSA-2026:2782, RLSA-2026:2781
Rocky Linux 9 nodejs-packaging 2021.06-5.module+el9.7.0+40050+22a42328 RLSA-2026:2783, RLSA-2026:2782, RLSA-2026:2781
Rocky Linux 8 nodejs 1:20.20.0-1.module+el8.10.0+40077+29236b21 RLSA-2026:2422, RLSA-2026:2421, RLSA-2026:2420
Rocky Linux 8 nodejs-nodemon 3.0.1-1.module+el8.9.0+1760+903d54b9 RLSA-2026:2422, RLSA-2026:2421, RLSA-2026:2420
Rocky Linux 8 nodejs-packaging 2021.06-6.module+el8.10.0+40048+6d99f608 RLSA-2026:2420
ReleasePackageFixed inAdvisory
SLES 15 SP7 nodejs22 22.22.0-150700.3.6.1 SUSE-SU-2026:0301-1
SLES 15 SP6 nodejs20 20.20.0-150600.3.15.1 SUSE-SU-2026:0435-1
SLES 15 SP6 nodejs22 22.22.0-150600.13.12.1 SUSE-SU-2026:0295-1
SLES 15 SP5 nodejs20 20.20.0-150500.11.24.1 SUSE-SU-2026:0457-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 nodejs22 22.22.0-160000.1.1 SUSE-SU-2026:20436-1
SLES for SAP 15 SP6 nodejs20 20.20.0-150600.3.15.1 SUSE-SU-2026:0435-1
SLES for SAP 15 SP6 nodejs22 22.22.0-150600.13.12.1 SUSE-SU-2026:0295-1
SLES for SAP 15 SP5 nodejs20 20.20.0-150500.11.24.1 SUSE-SU-2026:0457-1
SLES 16.0 nodejs22 22.22.0-160000.1.1 SUSE-SU-2026:20436-1
SLE HPC 15 SP5 nodejs20 20.20.0-150500.11.24.1 SUSE-SU-2026:0457-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed nodejs22 22.22.0-1.1 openSUSE-SU-2026:10074-1
openSUSE Tumbleweed nodejs24 24.13.0-1.1 openSUSE-SU-2026:10062-1
openSUSE Tumbleweed nodejs26 26.3.1-1.1 openSUSE-SU-2026:11110-1
openSUSE Leap 16.0 nodejs22 22.22.0-160000.1.1 openSUSE-SU-2026:20236-1
openSUSE Leap 15.6 nodejs20 20.20.0-150600.3.15.1 SUSE-SU-2026:0435-1
openSUSE Leap 15.6 nodejs22 22.22.0-150600.13.12.1 SUSE-SU-2026:0295-1
ReleasePackageFixed inAdvisory
Alpine v3.24 nodejs 24.13.0-r0 —
Alpine v3.23 nodejs 24.13.0-r0 —
Alpine v3.22 nodejs 22.22.0-r0 —
Alpine v3.21 nodejs 22.22.2-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs20 +4 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402
Amazon Linux 2023 nodejs20-npm 1:10.8.2-1.20.20.0.1.amzn2023.0.1 ALAS2023-2026-1402
Amazon Linux 2023 nodejs22 +4 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403
Amazon Linux 2023 nodejs22-npm 1:10.9.4-1.22.22.0.1.amzn2023.0.1 ALAS2023-2026-1403
Amazon Linux 2023 nodejs24 +4 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404
Amazon Linux 2023 nodejs24-npm 1:11.6.2-1.24.13.0.1.amzn2023.0.1 ALAS2023-2026-1404
Amazon Linux 2023 v8-11.3-devel 3:11.3.244.8-1.20.20.0.1.amzn2023.0.1 ALAS2023-2026-1402
Amazon Linux 2023 v8-12.4-devel 3:12.4.254.21-1.22.22.0.1.amzn2023.0.1 ALAS2023-2026-1403
Amazon Linux 2023 v8-13.6-devel 3:13.6.233.17-1.24.13.0.1.amzn2023.0.1 ALAS2023-2026-1404

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nodejs 20.14.0-13 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 nodejs +4 1:22.22.0-3.el10_1 ELSA-2026-1843
Oracle Linux 10 nodejs-npm 1:10.9.4-1.22.22.0.3.el10_1 ELSA-2026-1843
Oracle Linux 10 nodejs24 +4 1:24.13.0-1.0.1.el10_1 ELSA-2026-1842
Oracle Linux 10 nodejs24-npm 1:11.6.2-1.24.13.0.1.0.1.el10_1 ELSA-2026-1842
Oracle Linux 9 nodejs +3 1:20.20.0-1.module+el9.7.0+90815+f9676ed4 ELSA-2026-2783, ELSA-2026-2782, ELSA-2026-2781
Oracle Linux 9 nodejs-libs 1:22.22.0-1.module+el9.7.0+90816+ad59ca7b ELSA-2026-2782, ELSA-2026-2781
Oracle Linux 9 nodejs-nodemon 3.0.1-1.module+el9.7.0+90815+f9676ed4 ELSA-2026-2783, ELSA-2026-2782, ELSA-2026-2781
Oracle Linux 9 nodejs-packaging +1 2021.06-5.module+el9.7.0+90815+f9676ed4 ELSA-2026-2783, ELSA-2026-2782, ELSA-2026-2781
Oracle Linux 9 npm 1:10.8.2-1.20.20.0.1.module+el9.7.0+90815+f9676ed4 ELSA-2026-2783, ELSA-2026-2782, ELSA-2026-2781
Oracle Linux 9 v8-12.4-devel 3:12.4.254.21-1.22.22.0.1.module+el9.7.0+90816+ad59ca7b ELSA-2026-2782
Oracle Linux 9 v8-13.6-devel 3:13.6.233.17-1.24.13.0.1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781
Oracle Linux 8 nodejs +3 1:20.20.0-1.module+el8.10.0+90782+ddd3989e ELSA-2026-2422, ELSA-2026-2421, ELSA-2026-2420
Oracle Linux 8 nodejs-libs 1:22.22.0-1.module+el8.10.0+90783+325ded07 ELSA-2026-2421, ELSA-2026-2420
Oracle Linux 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+90677+9c05a177 ELSA-2026-2422, ELSA-2026-2421, ELSA-2026-2420
Oracle Linux 8 nodejs-packaging +1 2021.06-4.module+el8.10.0+90783+325ded07 ELSA-2026-2421, ELSA-2026-2420
Oracle Linux 8 npm 1:10.8.2-1.20.20.0.1.module+el8.10.0+90782+ddd3989e ELSA-2026-2422, ELSA-2026-2421, ELSA-2026-2420
Oracle Linux 8 v8-12.4-devel 3:12.4.254.21-1.22.22.0.1.module+el8.10.0+90783+325ded07 ELSA-2026-2421
Oracle Linux 8 v8-13.6-devel 3:13.6.233.17-1.24.13.0.0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling nodejs-20 +1 20.20.0-r0 —
Wolfi rolling nodejs-21 +1 No fix yet —
Wolfi rolling nodejs-22 +1 22.22.0-r0 —
Wolfi rolling nodejs-24 +1 24.13.0-r0 —
Wolfi rolling nodejs-25 25.3.0-r0 —

Advisories 50

References