Junglewise Threat Intelligence

CVE-2025-55131: Node.js uninitialized memory exposure in vm module buffer allocation

CVE-2025-55131 · Severity: high · CVSS 7.1 · Published 2026-01-20

Technologies: Red Hat Enterprise Linux AppStream, Node.js Project Node.Js. Vendors: Red Hat.

Executive brief

A security flaw in Node.js, a popular platform for building network applications, could allow sensitive information to be leaked from a server's memory. Under specific conditions where the system is under heavy load or processing untrusted input, internal data like passwords or security tokens might be accidentally exposed to unauthorized users. This could lead to data theft or corruption of information stored in the application's memory.

Technical details

A race condition exists in Node.js's buffer allocation logic when using the 'vm' module with the 'timeout' option. When an allocation is interrupted by a timeout, buffers created via 'Buffer.alloc' or 'TypedArray' (e.g., Uint8Array) may not be properly zero-filled, leaving them populated with uninitialized memory from previous operations. An attacker who can influence workloads to trigger these timeouts can potentially read sensitive in-process data or cause data corruption. The vulnerability is remotely exploitable if untrusted input can trigger the specific timing conditions required for the race condition. Fixes are available in Node.js versions 20.x, 22.x, 24.x, and 25.x.

Affected products

  • Node.js Project Node.js 20.x, 22.x, 24.x, 25.x
  • Red Hat Enterprise Linux AppStream 8, 9, 10

Timeline

  • 2026-01-13: advisory: Node.js project security release published
  • 2026-01-20: disclosed: CVE published to NVD
  • 2026-02-03: patched: Red Hat released security updates for RHEL 10

References

Related threats