This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Node.js fixes 8 vulnerabilities
Node.js fixes 8 vulnerabilities in versions 20.20.0, 22.22.0, 24.13.0 and 25.3.0 [1].
Due to a timing-dependent race condition during memory allocation, an unauthenticated remote attacker can obtain data from memory used by previous processes [1].
The vulnerability is present in product:
- Node.js; >=20.0.0, <20.20.0; >=22.0.0, <22.22.0; >=24.0.0, <24.13.0; >=25.0.0, <25.3.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-55131 at cve.org, NVD
- CWE-908: Use of Uninitialized Resource at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
By bypassing file access restrictions using crafted symbolic links, an unauthenticated remote attacker can read or write files without authorization, which may potentially lead to system compromise [1].
The vulnerability is present in product:
- Node.js; >=20.0.0, <20.20.0; >=22.0.0, <22.22.0; >=24.0.0, <24.13.0; >=25.0.0, <25.3.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-55130 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
Due to improper handling of a malformed HTTP/2 frame, an unauthenticated remote attacker can cause a DoS attack, especially in applications that do not handle error states on secure sockets [1].
The vulnerability is present in product:
- Node.js; >=20.0.0, <20.20.0; >=22.0.0, <22.22.0; >=24.0.0, <24.13.0; >=25.0.0, <25.3.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-59465 at cve.org, NVD
- CWE-703: Improper Check or Handling of Exceptional Conditions at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
Due to improper handling of an exception during deep recursion, an unauthenticated remote attacker can crash the process, which may lead to a DoS attack [1].
The vulnerability is present in product:
- Node.js; >=20.0.0, <20.20.0; >=22.0.0, <22.22.0; >=24.0.0, <24.13.0; >=25.0.0, <25.3.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-59466 at cve.org, NVD
- CWE-703: Improper Check or Handling of Exceptional Conditions at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
By CESNET, z.s.p.o. Henrieta Paločková on 15. 1. 2026.