CVE-2025-55131

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-20 · updated 2026-07-15
Weakness: CWE-120

Description

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.

Affected products

Node.js: from 20.19.6 through 20.19.6; from 22.21.1 through 22.21.1; from 24.12.0 through 24.12.0; from 25.2.1 through 25.2.1; 4.x from 4.0; 5.x from 5.0

References

Get alerted when CVE-2025-55131 or the next vulnerability affects your stack