Permission Model Flaw in Node.js Affects File Metadata Management

CVE-2025-55132

What is CVE-2025-55132?

A significant flaw in the permission model of Node.js allows unauthorized modification of file access and modification timestamps. This occurs through the use of the futimes() function, which bypasses traditional write permission checks. As a result, even processes with read-only access can alter file metadata in read-only directories. This vulnerability poses a risk of obscuring activity logs, thereby diminishing their reliability and integrity. The issue affects multiple versions of Node.js (v20, v22, v24, and v25), necessitating immediate attention from users relying on accurate logging and file management.

References