CVE-2025-55130

EUVD-2026-3338

20.01.2026, 21:16

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
hackerone	CNA	7.1 HIGH				CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 1%

Affected Products (NVD)

Vendor	Product	Version
nodejs	node.js	20.0.0 ≤ 𝑥 < 20.20.0
nodejs	node.js	22.0.0 ≤ 𝑥 < 22.22.0
nodejs	node.js	24.0.0 ≤ 𝑥 < 24.13.0
nodejs	node.js	25.0.0 ≤ 𝑥 < 25.3.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nodejs

bookworm	vulnerable
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	22.22.0+dfsg+~cs22.19.6-1 fixed
sid	22.22.0+dfsg+~cs22.19.13-2 fixed
trixie	vulnerable

Common Weakness Enumeration

CWE-289 - Authentication Bypass by Alternate Name
The software performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

References

https://nodejs.org/en/blog/vulnerability/december-2025-security-releases