CVE-2025-55131

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development.

An uninitialized memory exposure vulnerability (CVE-2025-55131) has been identified in Node.js, where buffer allocations interrupted by a vm module timeout can leave the runtime with zero-filling switched off. Memory handed back by Buffer.alloc and by TypedArray constructors such as Uint8Array can then still hold leftover data from earlier operations, which may expose in-process secrets such as tokens or passwords, or corrupt data that assumed a zeroed buffer.

Per MITRE CWE-497, Exposure of Sensitive System Information to an Unauthorized Control Sphere: "The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does." The underlying mechanism is also described by MITRE CWE-908, Use of Uninitialized Resource: "The product uses or accesses a resource that has not been initialized."

This issue affects every version of the End-of-Life Node.js 4.x through 18.x release lines, along with Node.js 20.x up to and including 20.19.6, 22.x up to and including 22.21.1, 24.x up to and including 24.12.0, and 25.x up to and including 25.2.1.

Details

Module Info

• Product: Node.js
• Affected packages: nodejs/node (the Node.js runtime itself)
• Affected versions:
  • 4.x – 18.x (End-of-Life release lines, all versions)
  • 20.x ≤ 20.19.6
  • 22.x ≤ 22.21.1
  • 24.x ≤ 24.12.0
  • 25.x ≤ 25.2.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://github.com/nodejs/node/releases
• Package manager: n/a (Node.js ships as a runtime distribution rather than a registry package)
• Fixed in: Upstream Node.js 20.20.0, 22.22.0, 24.13.0 and 25.3.0, released January 13, 2026; NES for Node.js v18.20.14 (January 22, 2026), v16.20.9 (January 23, 2026), v14.21.8 (January 27, 2026)

Vulnerability Info

This High-severity vulnerability is found in the Node.js buffer allocation path in the runtime core, in code shared between the C++ layer and the JavaScript library, and it is reachable in every affected release line whenever the vm module is used with the timeout option.

Node.js zero-fills buffer memory by default. As the Buffer documentation describes, Buffer.alloc() returns memory that has been initialized, and TypedArray constructors behave the same way, while Buffer.allocUnsafe() is the documented opt-out for callers that will overwrite every byte. Internally the runtime carried a shared zero-fill toggle: it switched zero-filling off around allocations that were about to be fully overwritten, then switched it back on.

The flaw is that the toggle was not restored when execution was interrupted between those two steps. A vm module timeout firing inside that window unwinds without turning zero-filling back on, so the runtime keeps handing back memory it never initialized. Subsequent calls to Buffer.alloc() or new Uint8Array() return heap memory that may still contain bytes from earlier operations, which is an information exposure of whatever those earlier operations held, and a source of data corruption for code that relies on a zeroed buffer. The upstream fix removed the zero-fill toggle entirely and reworked unsafe buffer creation so that no global state has to be restored.

Exploitation normally requires precise timing or the ability to run code in the same process. It becomes remotely reachable where untrusted input influences both the workload and the timeout values, which is the case the Node.js project rates as High. The reachable path runs through the vm module, which the Node.js documentation states is not a security mechanism and should not be used to run untrusted code, so the exposure is concentrated in applications that use vm with timeouts rather than in Node.js applications generally.

Note: Buffers created with Buffer.allocUnsafe() are documented as returning non-zeroed memory and are not part of this issue. What is at fault here is that allocations documented to be zero-filled stopped being zero-filled.

Mitigation

The Node.js 4.x through 18.x release lines are past their End-of-Life dates and will not receive an upstream fix for this issue. The 20.x and 25.x lines did receive the upstream fix, in 20.20.0 and 25.3.0, but have since reached End-of-Life themselves. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js release line at or above the patched version (22.22.0 or later on the 22.x line, or 24.13.0 or later on the 24.x line).
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Nikita Skovoroda (reporter, remediation developer)