Threats tagged 'bit-node-2025-55132'

A vulnerability in Node.js's permission model allows modification of a file's access and modification timestamps via the futimes() function even when the process only has read permissions. This occurs because futimes() does not enforce the expected write-permission checks, unlike utimes(). This flaw affects Node.js versions 20.0.0 up to but not including 20.20.0, 21.0.0 up to but not including 22.22.0, 23.0.0 up to but not including 24.13.0, and 25.0.0 up to but not including 25.3.0. The vulnerability could be used to obscure file activity by altering timestamps, impacting the reliability of logs. A patch is available to address this issue.