The Node.js project has released a coordinated security update for all active release lines 20.x, 22.x, 24.x, and 25.x,addressing 8 documented vulnerabilities, including 3 rated High, 4 Medium, and 1 Low, alongside critical dependency updates for c-ares and undici.
The security releases, announced on Tuesday, January 13, 2026, are delivered in Node.js versions 20.20.0, 22.22.0, 24.13.0, and 25.3.0.
According to the project, all supported lines are affected by multiple remotely triggerable denial-of-service conditions, memory handling flaws, and permission model bypasses, underscoring the urgency for administrators to deploy patches in production environments.
The most severe issues include a buffer allocation race condition that can leak uninitialized memory when using the vm module with timeouts, potentially exposing in-process secrets via Buffer.alloc and typed arrays (CVE-2025-55131), and a file system permission bypass, where crafted symlink chains can break out of --allow-fs-read/--allow-fs-write sandboxes (CVE-2025-55130).
Both flaws affect all active release lines and pose a high risk of multi-tenant or untrusted-code execution.
A third High‑severity bug in the HTTP/2 implementation allows malformed HEADERS frames with invalid HPACK data to crash Node.js with an unhandled TLSSocket ECONNRESET error, enabling remote denial-of-service attacks against servers that lack robust error handlers on secure sockets (CVE-2025-59465).
On the Medium side, maintainers fixed an uncatchable “Maximum call stack size exceeded” path involving async_hooks.createHook() that bypasses process.on('uncaughtException'), a TLS client-certificate memory leak tied to socket.getPeerCertificate(true), a Unix Domain Socket permission bypass in the experimental permission model, and a TLS PSK/ALPN callback handling flaw that can crash servers or leak file descriptors during handshake failures.
A Low‑severity bug in fs.futimes() further allowed timestamp modification in ostensibly read‑only contexts, undermining audit and logging reliability.
Node.js maintainers reiterate that End-of-Life branches are implicitly affected whenever a security advisory is released, and strongly advise users to migrate to supported versions in accordance with the official release schedule.
Production operators are urged to upgrade immediately and review their use of the permission model, HTTP/2, TLS client certificates, and async hooks in light of these fixes.
| CVE ID | Severity | Component / Area | Impacted Lines | Key Impact / Risk |
|---|---|---|---|---|
| CVE-2025-55131 | High | Buffer.alloc / TypedArray + vm timeouts | 20.x, 22.x, 24.x, 25.x | Uninitialized memory exposure; potential secret/data leakage |
| CVE-2025-55130 | High | Permission model symlink handling | 20.x, 22.x, 24.x, 25.x | Bypass --allow-fs-read/write; arbitrary file R/W |
| CVE-2025-59465 | High | HTTP/2 HEADERS / HPACK | 20.x, 22.x, 24.x, 25.x | Remote DoS via process crash on malformed frames |
| CVE-2025-59466 | Medium | async_hooks / AsyncLocalStorage | 20.x, 22.x, 24.x, 25.x | Uncatchable stack overflow leading to unrecoverable DoS |
| CVE-2025-59464 | Medium | TLS client certificate handling (OpenSSL) | 20.x, 22.x, 24.x | Memory leak via getPeerCertificate(true); resource exhaustion |
| CVE-2026-21636 | Medium | Permission model UDS handling | 25.x | UDS connects bypass --allow-net; local privilege exposure |
| CVE-2026-21637 | Medium | TLS PSK/ALPN callback error handling | Multiple TLS server configs | Remote DoS, FD leak via mis-handled callback exceptions |
| CVE-2025-55132 | Low | fs.futimes() permission checks | 20.x, 22.x, 24.x, 25.x | Read-only model bypass for file timestamps; log tampering |
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1)%20(1).webp?fit=1600,900&ssl=1&description=The security releases, announced on Tuesday, January 13, 2026, are delivered in Node.js versions 20.20.0, 22.22.0, 24.13.0, and 25.3.0.){kind=link}