QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-55132

Back to search

CVE-2025-55132

Published: Jan 20, 2026

Modified: Jan 21, 2026

PUBLISHED

CVSS v3.0

2.8

LOW

Description

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

VendorProductVersions

nodejs

node

affected
20.19.6 - <= 20.19.6
affected
22.21.1 - <= 22.21.1
affected
24.12.0 - <= 24.12.0
affected
25.2.1 - <= 25.2.1

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now