CVE-2025-55131: 
npm vulnerability analysis and mitigation

CVE-2025-55131 is a high-severity uninitialized memory exposure vulnerability in Node.js's buffer allocation logic, titled "Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled." When the vm module is used with the timeout option, interrupted buffer allocations can leave Buffer.alloc and TypedArray instances (e.g., Uint8Array) containing residual data from prior operations, potentially exposing in-process secrets such as tokens or passwords. The vulnerability affects all active Node.js release lines: 20.x, 22.x, 24.x, and 25.x, and was disclosed on January 13, 2026, with the CVE published on January 20, 2026. It carries a CVSS v3.0 base score of 7.1 (High), assigned by HackerOne (Node.js Advisory, Red Hat Bugzilla).

The root cause is a race condition in Node.js's buffer zeroing logic: when a vm module script execution is interrupted by a timeout, the memory zeroing step for newly allocated Buffer.alloc or Uint8Array instances may not complete, leaving the buffer populated with stale heap data from previous operations (CWE-497: Exposure of Sensitive System Information; CWE-120: Buffer Copy without Checking Size of Input). An attacker who can influence workload execution and timeout parameters — for example, by submitting untrusted input that controls script complexity or timeout values — can trigger the race condition remotely. The vulnerability was reported and fixed by Nikita Skovoroda, and the fix was included in the January 13, 2026 security releases (Node.js Advisory, Red Hat Bugzilla).

Successful exploitation can result in confidentiality and integrity impacts: sensitive in-process data such as authentication tokens, passwords, or cryptographic material may be leaked through uninitialized buffer contents, and data corruption may occur if the stale memory is subsequently used in application logic. The vulnerability has high confidentiality and integrity impact with low availability impact per its CVSS scoring. In multi-tenant or server-side JavaScript execution environments where untrusted code runs via the vm module, the risk of cross-tenant secret leakage is elevated. IBM Observability with Instana (OnPrem) is among the downstream products confirmed affected (Node.js Advisory, IBM Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-55131. The EPSS score is approximately 0.023% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity — specifically, precise timing to interrupt buffer allocation during a vm module timeout — and at minimum low-privileged network access, making opportunistic exploitation unlikely without targeted effort (Node.js Advisory, Red Hat CVE).

1. Identify target: Locate a Node.js application (versions 20.x, 22.x, 24.x, or 25.x) that uses the vm module with the timeout option and accepts untrusted user input that influences script content or timeout values.
2. Craft workload input: Submit input designed to create a computationally intensive script that will be interrupted by the vm timeout, triggering the race condition during buffer allocation (e.g., a tight loop or recursive function that causes the timeout to fire mid-allocation).
3. Trigger race condition: Send repeated requests to maximize the probability that a Buffer.alloc or Uint8Array allocation is interrupted at the precise moment the zeroing step is skipped, leaving residual heap data in the buffer.
4. Observe leaked data: Capture application responses or side-channel outputs that include the uninitialized buffer contents, which may contain fragments of in-process secrets (tokens, passwords, cryptographic keys) from prior operations.
5. Iterate: Repeat with varying timing and payload sizes to increase the likelihood of capturing sensitive residual data, as exploitation depends on precise timing conditions (Node.js Advisory).

• Logs: Unusual or repeated requests to endpoints that invoke vm.runInNewContext(), vm.Script, or similar vm module APIs with user-controlled timeout parameters; application logs showing frequent timeout errors from vm module execution.
• Application Behavior: Unexpected data appearing in API responses that does not correspond to the current request context, potentially indicating buffer content leakage.
• Network: High-frequency requests from a single source targeting vm-module-backed endpoints, consistent with timing-based probing to trigger the race condition.
• Process: Elevated CPU usage patterns consistent with repeated script execution and timeout interruption cycles in the Node.js process.

Node.js released patched versions on January 13, 2026: Node.js 20.20.0, 22.22.0, 24.13.0, and 25.3.0. All users on active release lines should upgrade immediately. As a workaround where upgrading is not immediately possible, avoid using the vm module's timeout option with untrusted input, or restrict user control over script content and timeout values. Red Hat has issued multiple errata (RHSA-2026:1842, 1843, 2420, 2421, 2422, 2767, 2768, 2781, 2782, 2783, 2864, 2899) for RHEL 8, 9, and 10. IBM has also released patches for affected Instana OnPrem versions (Node.js Advisory, Red Hat Bugzilla, IBM Advisory).

The Node.js security release addressing CVE-2025-55131 received broad coverage from security media outlets including The Hacker News, GBHackers, SecurityOnline, and CyberSecurityNews, with several articles highlighting the broader batch of seven vulnerabilities fixed in the release. The German Federal Office for Information Security (BSI) issued an advisory noting the high-risk nature of the Node.js security vulnerabilities. Endor Labs published a technical digest covering all eight vulnerabilities fixed in the runtime. Community discussion on oss-security mailing lists (seclists.org) also addressed the release. Overall sentiment emphasized the importance of prompt upgrades given the breadth of affected release lines (Node.js Advisory, Endor Labs).