Is CVE-2025-55131 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-55131 being exploited in the wild.

How severe is CVE-2025-55131?

High severity, with a CVSS score of 7.1, published 20 January 2026.

Which products and versions are affected?

Red Hat Enterprise Linux AppStream 8, 9, 10.

Is there a fix for CVE-2025-55131?

A patch was published on 2026-02-03: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-55131 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-55131?

Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-55131: Node.js uninitialized memory exposure in vm module buffer allocation

CVE-2025-55131 · Severity: high · CVSS 7.1 · Published 2026-01-20

A security flaw in Node.js, a popular platform for building network applications, could allow sensitive information to be leaked from a server's memory. Under specific conditions where the system is under heavy load or processing untrusted input, internal data like passwords or security tokens might be accidentally exposed to unauthorized users. This could lead to data theft or corruption of information stored in the application's memory.

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Quick answers

Is CVE-2025-55131 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-55131 being exploited in the wild.
How severe is CVE-2025-55131?: High severity, with a CVSS score of 7.1, published 20 January 2026.
Which products and versions are affected?: Red Hat Enterprise Linux AppStream 8, 9, 10.
Is there a fix for CVE-2025-55131?: A patch was published on 2026-02-03: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-55131 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-55131?: Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in Node.js's buffer allocation logic when using the 'vm' module with the 'timeout' option. When an allocation is interrupted by a timeout, buffers created via 'Buffer.alloc' or 'TypedArray' (e.g., Uint8Array) may not be properly zero-filled, leaving them populated with uninitialized memory from previous operations. An attacker who can influence workloads to trigger these timeouts can potentially read sensitive in-process data or cause data corruption. The vulnerability is remotely exploitable if untrusted input can trigger the specific timing conditions required for the race condition. Fixes are available in Node.js versions 20.x, 22.x, 24.x, and 25.x.

Affected products

Node.js Project Node.js 20.x, 22.x, 24.x, 25.x
Red Hat Enterprise Linux AppStream 8, 9, 10

Timeline

2026-01-13: advisory: Node.js project security release published
2026-01-20: disclosed: CVE published to NVD
2026-02-03: patched: Red Hat released security updates for RHEL 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.