CVE-2025-55132

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read…

Low · published January 20, 2026

CVSS v3.0
2.8
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

The record
Technical detail
CVSS v3.0
2.8 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Published
2026-01-20T20:41Z
EPSS history
Timeline
  • 20 JAN 20:41Z
    A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read…
    cvelistv5