CVE-2025-55132

Name of the Vulnerable Software and Affected Versions Node.js versions 20 through 25

Description A flaw in Node.js’s permission model allows modification of a file’s access and modification timestamps using the futimes() function, even with read-only permissions. Unlike utimes(), futimes() bypasses standard write-permission checks, enabling metadata changes in read-only directories. This could potentially obscure activity and compromise log reliability. The vulnerable function is futimes().

Recommendations Update to a newer version that contains a fix for this vulnerability.