CVE-2025-55132

score

<0.1

cvss

5.3

epss

0.3%

published

2026-01-20

kev added

—

first seen

2026-10-21

Node.js v20, v22, v24, and v25 contain a broken access control vulnerability caused by missing write-permission checks in futimes(), letting attackers modify file access and modification timestamps in read-only directories, exploit requires file system access.