CVE-2025-55131 Information disclosure in node
Node.js buffer allocation flaw exposes uninitialized memory, potentially leaking secrets or corrupting data when using the vm module with timeouts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55131?
CVE-2025-55131 is a high-severity vulnerability in nodejs node, published on 20 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
Which versions are affected by CVE-2025-55131?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 20.20.0, 22.22.0, 24.13.0, 25.3.0 |
node-min Bitnami | All versions | 20.20.0, 22.22.0, 24.13.0, 25.3.0 |
How do I fix CVE-2025-55131?
Upgrade node to a fixed version for your release line: 20.20.0, 22.22.0, 24.13.0 or 25.3.0.
Is CVE-2025-55131 being exploited?
There is no known exploitation of CVE-2025-55131 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-55131, AZL-74967, AZL-74979, BELL-CVE-2025-55131, BIT-node-2025-55131, BIT-node-min-2025-55131 and 11 more.