UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55132

fs.futimes() Bypasses Read-Only Permission Model

Severity
Medium 5.3
Published
13 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.20.0, 22.22.0, 24.13.0, 25.3.0
Sources
NVD, nodejs

Description

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity,…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 20.0.0 before 20.20.0
  • From 22.0.0 before 22.22.0
  • From 24.0.0 before 24.13.0
  • From 25.0.0 before 25.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55132
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55132
  • Node.js security release https://nodejs.org/en/blog/vulnerability/december-2025-security-releases