Critical Node.js Vulnerabilities Expose Uninitialized Memory (CVE-2025-55131)

CVE-2025-55131 is a high-severity buffer allocation race condition vulnerability in Node.js that can lead to uninitialized memory exposure when using the vm module with execution timeouts. This vulnerability is part of a coordinated Node.js security update addressing eight vulnerabilities across all active release lines.

The affected vulnerabilities span memory handling vulnerabilities, permission model bypasses, remote denial-of-service conditions, and local privilege exposure, making this update critical for organizations running Node.js in production, especially in multi-tenant or untrusted code execution environments.

Risk Analysis: CVE-2025-55131 and Other Node.js Vulnerabilities

CVE-2025-55131 is part of a coordinated Node.js security update addressing eight distinct vulnerabilities across all active release lines. The overall risk is elevated due to the combination of high-severity memory exposure vulnerabilities, permission model bypasses, and remotely triggerable denial-of-service conditions, many of which affect core runtime components.

Risk Analysis

Severity: HIGH
CVSSv3.1: Base Score: 8.1 HIGH
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit available in public: No (as of now)

Reachability – The vulnerable functionality is reachable from the internet in typical Node.js deployments.

The availability of PoCs significantly lowers the barrier to exploitation, increasing the likelihood of rapid weaponization. Even without confirmed in-the-wild attacks, public disclosure combined with exploitable primitives places unpatched systems at heightened risk.

In addition to CVE-2025-55131, this Node.js security update addresses multiple other vulnerabilities across all active release lines, significantly expanding the overall risk surface.

The update includes a total of eight vulnerabilities, comprising:

3 High-severity Vulnerabilities

Uninitialized Memory Exposure

CVE-2025-55131 introduces a buffer allocation race condition involving Buffer.alloc, typed arrays, and the vm module when execution timeouts are applied. This can expose uninitialized memory and leak sensitive in-process data, including secrets, tokens, or application state. The risk is particularly high in environments that execute untrusted or semi-trusted code, such as server-side rendering, plugin systems, or multi-tenant platforms.

Permission Model Bypass and Arbitrary File Access

CVE-2025-55130 allows attackers to bypass –allow-fs-read and –allow-fs-write restrictions using crafted symlink chains. This breaks the Node.js permission model, enabling arbitrary file read and write operations and undermining sandboxing assumptions.

Remote Denial of Service

CVE-2025-59465 affects Node.js HTTP/2 handling, where malformed HEADERS frames with invalid HPACK data can trigger unhandled ECONNRESET errors. This allows attackers to crash Node.js servers remotely, resulting in service disruption without authentication.

While not all vulnerabilities are individually critical, their presence within the same runtime significantly expands the attack surface and enables chained exploitation scenarios.

Several vulnerabilities can be triggered remotely through malformed network traffic (HTTP/2, TLS handling), while others can be exploited locally or within sandboxed execution contexts. This dual exposure makes the vulnerabilities relevant to both internet-facing services and internal multi-tenant environments.

Medium and Low Severity Risks That Compound Impact

In addition to the high-severity vulnerabilities, several medium- and low-severity vulnerabilities further weaken runtime stability and isolation:

• An uncatchable stack overflow via async_hooks.createHook() can cause unexpected process termination.
• A TLS client-certificate memory leak and TLS PSK / ALPN callback handling vulnernerability may lead to resource exhaustion, crashes, or file descriptor leaks over time.
• A Unix Domain Socket permission bypass affects the experimental permission model, further eroding trust in sandbox enforcement.
• The low-severity CVE-2025-55132 allows timestamp modification via fs.futimes() in read-only contexts, weakening audit integrity and log reliability.

While individually less impactful, these vulnerabilities amplify overall risk when combined, enabling attackers to degrade availability, bypass controls, and obscure forensic evidence.

Many of the affected code paths are reachable from the internet in typical Node.js deployments, and exploitation may occur through remote or local vectors, often without authentication, depending on the vulnerability.

CVE-2025-55131 Detection and Mitigation

• Review your application stack to identify usage of affected frameworks or components. Specifically, check usage of the Node.js vm module, permission model (–allow-fs-read/–allow-fs-write), HTTP/2 implementation, TLS client certificates, and async_hooks.
• Apply vendor-recommended mitigations or configuration workarounds, if available.
• Patch or upgrade to fixed versions immediately: Node.js 20.20.0, 22.22.0, 24.13.0, and 25.3.0 or later, as advised by the vendor.
• Follow secure deployment practices for server-side rendering and dynamic components.
• Periodically review exposed application endpoints and attack surface.
• Migrate any End-of-Life Node.js branches to supported versions.

CVE-2025-55131 – AppTrana WAAP Coverage

AppTrana WAAP provides default protection against known exploit patterns targeting CVE-2025-55131 and associated Node.js runtime vulnerabilities. Customers running AppTrana in Block Mode benefit from pre-enabled detection and mitigation controls, with additional rule hardening released by managed security team on January 15, 2026.

AppTrana-Specific Actions

Indusface recommends the following actions to reduce risk:

• Ensure all internet-facing applications are protected by Indusface WAF in Block Mode
• Enable Origin Protection to prevent direct access to backend servers

Stay tuned for more relevant and interesting security articles. Follow Indusface on Facebook, Twitter, and LinkedIn.