What is CVE-2025-55131?

CVE-2025-55131 is a high-severity vulnerability in Nodejs Node. CVSS score: 7.1/10. Published 2026-01-20.

How severe is CVE-2025-55131?

High severity. CVSS v3 base score is 7.1 out of 10.

Vulnerability in Nodejs Node

CVE-2025-55131

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and o…

EPSS: 0.000 (12.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L.

Affected products

Nodejs Node — versions 20.19.6, 22.21.1, 24.12.0

References

nodejs.org/en/blog/vulnerability/december-2025-security-releases

Frequently asked questions

What is CVE-2025-55131?: CVE-2025-55131 is a high-severity vulnerability in Nodejs Node. CVSS score: 7.1/10. Published 2026-01-20.
How severe is CVE-2025-55131?: High severity. CVSS v3 base score is 7.1 out of 10.