A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only… (CVE-2025-55132)
A vulnerability in Node.js's permission model allows modification of a file's access and modification timestamps via the futimes() function even when the process only has read permissions. This occurs because futimes() does not enforce the expected write-permission checks, unlike utimes(). This flaw affects Node.js versions 20.0.0 up to but not including 20.20.0, 21.0.0 up to but not including 22.22.0, 23.0.0 up to but not including 24.13.0, and 25.0.0 up to but not including 25.3.0. The vulnerability could be used to obscure file activity by altering timestamps, impacting the reliability of logs. A patch is available to address this issue.
AI Analysis
Technical Summary
Node.js contains a permission model flaw where the futimes() system call allows modification of file access and modification timestamps without requiring write permissions. This contrasts with utimes(), which enforces write-permission checks. As a result, processes with only read permissions can alter file metadata timestamps in read-only directories. This vulnerability affects multiple Node.js versions across major releases 20, 21, 23, and 25, specifically versions >=20.0.0 <20.20.0, >=21.0.0 <22.22.0, >=23.0.0 <24.13.0, and >=25.0.0 <25.3.0. The issue could be exploited to tamper with file timestamps, potentially obscuring forensic and logging data. A patch is available to fix this permission model flaw.
Potential Impact
The vulnerability allows unauthorized modification of file access and modification timestamps even when only read permissions are granted. This can be used to alter file metadata in read-only directories, potentially obscuring file activity and reducing the reliability of audit logs and forensic investigations. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update affected Node.js versions to the fixed releases beyond the specified affected version ranges. No additional mitigation steps are indicated by the vendor advisory.
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only… (CVE-2025-55132)
Description
A vulnerability in Node.js's permission model allows modification of a file's access and modification timestamps via the futimes() function even when the process only has read permissions. This occurs because futimes() does not enforce the expected write-permission checks, unlike utimes(). This flaw affects Node.js versions 20.0.0 up to but not including 20.20.0, 21.0.0 up to but not including 22.22.0, 23.0.0 up to but not including 24.13.0, and 25.0.0 up to but not including 25.3.0. The vulnerability could be used to obscure file activity by altering timestamps, impacting the reliability of logs. A patch is available to address this issue.
Affected software
pkg:bitnami/nodeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Node.js contains a permission model flaw where the futimes() system call allows modification of file access and modification timestamps without requiring write permissions. This contrasts with utimes(), which enforces write-permission checks. As a result, processes with only read permissions can alter file metadata timestamps in read-only directories. This vulnerability affects multiple Node.js versions across major releases 20, 21, 23, and 25, specifically versions >=20.0.0 <20.20.0, >=21.0.0 <22.22.0, >=23.0.0 <24.13.0, and >=25.0.0 <25.3.0. The issue could be exploited to tamper with file timestamps, potentially obscuring forensic and logging data. A patch is available to fix this permission model flaw.
Potential Impact
The vulnerability allows unauthorized modification of file access and modification timestamps even when only read permissions are granted. This can be used to alter file metadata in read-only directories, potentially obscuring file activity and reducing the reliability of audit logs and forensic investigations. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update affected Node.js versions to the fixed releases beyond the specified affected version ranges. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2025-55132
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-55132"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa005faacd9273b49ab68a9
Added to database: 09/08/2026, 12:56:26 UTC
Last enriched: 09/08/2026, 13:36:51 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 30
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.