Node.js Patches Memory Leak and Permission Bypasses

Node.js has issued a critical security update addressing a trio of high-severity vulnerabilities that could cause data leaks, DoS conditions, and authentication bypasses, with patches rolling out across 25.x, 24.x, 22.x and 20.x release lines.

At the forefront is CVE-2025-55131, a memory-allocation flaw where buffers may retain data from previous operations when interrupted, potentially exposing in-process secrets like tokens or passwords; according to the report, this can occur when using the vm module with a timeout option.

Two further issues target Node.js’s experimental Permission Model: CVE-2025-55130, a symlink bypass allowing read access to sensitive files via crafted relative symlink paths, and CVE-2026-21636, a Unix Domain Socket bypass enabling network restriction circumvention when –permission is enabled. DoS vectors are also fixed, including CVE-2025-59465 linked to a malformed HTTP/2 HEADERS frame and CVE-2026-21637 relating to TLS callback crashes. The patched releases are Node.js 20.20.0, 22.22.0, 24.13.0, and 25.3.0, and developers are urged to update to prevent data leaks and service disruptions.