CVE-2025-55132: 
npm vulnerability analysis and mitigation

CVE-2025-55132 is a low-severity permission model bypass vulnerability in Node.js, specifically affecting the fs.futimes() function. The flaw allows a process with only read permissions to modify a file's access and modification timestamps, bypassing the expected write-permission checks enforced by the permission model. It affects Node.js v20.x (before 20.20.0), v22.x (before 22.22.0), v24.x (before 24.13.0), and v25.x (before 25.3.0). The vulnerability was reported by 'oriotie', disclosed on January 20, 2026, and patched in the January 13, 2026 security release. CVSS v3.1 base score is 5.3 (Medium) per NVD, though the CNA (HackerOne) assigned a score of 2.8 (Low) (Node.js Advisory, Red Hat CVE).

The root cause is an inconsistency in how Node.js's permission model applies write-permission checks to file system operations (CWE-276: Incorrect Default Permissions; CWE-281: Improper Preservation of Permissions). Specifically, fs.futimes() — which modifies timestamps using a file descriptor — does not enforce the same write-permission validation that fs.utimes() applies when using a file path. This means that a Node.js process running under --permission mode with only --allow-fs-read can open a file descriptor and then call futimes() to alter its timestamps without triggering a permission denial. The fix was implemented by RafaelGSS and involves applying the same write-permission checks to futimes() as are applied to utimes() (Node.js Advisory, Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to alter file access and modification timestamps on files in read-only directories, even when the Node.js permission model is active. This primarily undermines log integrity and forensic reliability, as timestamp manipulation can obscure the timing of file access or modification events, complicating incident response and audit trails. The vulnerability does not directly enable code execution, data exfiltration, or denial of service, making its practical impact limited to integrity of file metadata (Node.js Advisory, Red Hat CVE).

1. Identify target environment: Confirm the target Node.js application is running with the --permission flag and --allow-fs-read but without --allow-fs-write, on an affected version (v20.x < 20.20.0, v22.x < 22.22.0, v24.x < 24.13.0, or v25.x < 25.3.0).
2. Obtain code execution context: Gain the ability to execute arbitrary JavaScript within the Node.js process (e.g., via a malicious module, supply chain compromise, or other code injection vector).
3. Open a file descriptor: Use fs.openSync() or fs.open() with read-only flags ('r') to obtain a file descriptor for a target file in a read-only directory — this is permitted under --allow-fs-read.
4. Call fs.futimes(): Invoke fs.futimes(fd, atime, mtime, callback) with the obtained file descriptor and desired forged timestamps. Because futimes() does not check write permissions, the call succeeds despite the process lacking write access.
5. Achieve timestamp manipulation: The file's access and modification timestamps are now altered, potentially obscuring evidence of prior file access or covering tracks of malicious activity in audit logs (Node.js Advisory).

• Logs: Unexpected or inconsistent file timestamps in audit logs, particularly for files in directories where the Node.js process should only have read access; discrepancies between filesystem timestamps and application-level access logs.
• Process: Node.js processes launched with --permission and --allow-fs-read flags making futimes() system calls on files outside their expected write scope; unusual futimes/futimesat syscall activity from Node.js processes in system call audit logs (e.g., Linux auditd).
• File System: Files in read-only directories with recently modified atime or mtime values that do not correspond to any legitimate write operations; timestamp values set to unusual dates (e.g., far in the past or future) to obscure activity.

Upgrade Node.js to the patched versions: v20.20.0, v22.22.0, v24.13.0, or v25.3.0, which apply the correct write-permission checks to fs.futimes(). Red Hat Enterprise Linux users should apply the relevant errata: RHSA-2026:1842/1843 (RHEL 10), RHSA-2026:2420/2421/2422 (RHEL 8), and RHSA-2026:2781/2782/2783 (RHEL 9). As a workaround, avoid relying solely on the Node.js permission model for security-critical isolation, and implement additional OS-level access controls (e.g., filesystem permissions, seccomp profiles) to restrict what Node.js processes can do. Monitor file metadata changes in sensitive directories using file integrity monitoring tools (Node.js Advisory, Red Hat Bugzilla, IBM Advisory).

The Node.js project disclosed this vulnerability as part of a broader January 2026 security release addressing eight vulnerabilities across all active release lines, with CVE-2025-55132 rated the lowest severity (Low) among them. Security researchers at Endor Labs published a technical summary covering all eight vulnerabilities fixed in this release (Endor Labs). Coverage was largely routine, with security news outlets noting the release without highlighting this specific CVE as a critical concern given its limited exploitability and low severity rating.