Skip to content

Commit 632645e

Browse files
RafaelGSSCopilot
RafaelGSS
and
Copilot
authored
Blog: add January 13 security release (#8538)
* Blog: add January 13 security release * Update apps/site/pages/en/blog/vulnerability/december-2025-security-releases.md Co-authored-by: Copilot <[email protected]> Signed-off-by: Rafael Gonzaga <[email protected]> * Update apps/site/pages/en/blog/vulnerability/december-2025-security-releases.md Co-authored-by: Copilot <[email protected]> Signed-off-by: Rafael Gonzaga <[email protected]> --------- Signed-off-by: Rafael Gonzaga <[email protected]> Co-authored-by: Copilot <[email protected]>
1 parent 8f22da6 commit 632645e

File tree

2 files changed

+140
-25
lines changed

2 files changed

+140
-25
lines changed

‎apps/site/pages/en/blog/vulnerability/december-2025-security-releases.md‎

Lines changed: 137 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,156 @@
11
---
2-
date: 2025-12-08T23:00:00.000Z
2+
date: 2026-01-13T00:00:00.000Z
33
category: vulnerability
44
title: Tuesday, January 13, 2026 Security Releases
55
slug: december-2025-security-releases
66
layout: blog-post
77
author: The Node.js Project
88
---
99

10-
## (Update 08-Jan-2026) Security Release postponed to January 13th
10+
## Security releases available
1111

12-
Our team has decided to postpone the release to Tuesday, January 13th, 2026.
13-
This additional time will allow us to properly test all backports and re-run CITGM
14-
to ensure the highest quality for our users. Additionally, releasing on Tuesday rather
15-
than Friday helps ensure that security updates are available during regular business
16-
hours across all time zones, particularly for our users in the Asia-Pacific region.
12+
Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines
13+
to address:
1714

18-
We appreciate your patience and understanding as we work to deliver a secure and
19-
reliable release. If you have any questions or need assistance, please feel free to
20-
join us in the [OpenJS Foundation Slack](https://openjs-foundation.slack.com/).
15+
- 3 high severity issues.
16+
- 4 medium severity issues.
17+
- 1 low severity issue.
18+
19+
This security release includes the following dependency updates to address public vulnerabilities:
20+
21+
- c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x
22+
- undici (6.23.0, 7.18.0) on 20.x, 22.x, 24.x, 25.x
23+
24+
## Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131) - (High)
25+
26+
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted,
27+
when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated
28+
with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous
29+
operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption.
30+
31+
While exploitation typically requires precise timing or in-process code execution, it can become remotely
32+
exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and
33+
integrity impact.
34+
35+
Impact:
36+
37+
- This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x, 25.x
38+
39+
Thank you, to Nikita Skovoroda for reporting and fixing this vulnerability.
40+
41+
## Bypass File System Permissions using crafted symlinks (CVE-2025-55130) - (High)
42+
43+
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write`
44+
restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted
45+
access only to the current directory can escape the allowed path and read sensitive files. This breaks the
46+
expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
47+
48+
Impact:
49+
50+
- This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
51+
52+
Thank you, to natann for reporting this vulnerability and thank you RafaelGSS for fixing it.
53+
54+
## Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465) - (High)
55+
56+
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by
57+
triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the
58+
process crashes, enabling a remote denial of service. This primarily affects applications that do not
59+
attach explicit error handlers to secure sockets, for example:
60+
61+
```js
62+
server.on('secureConnection', socket => {
63+
socket.on('error', err => {
64+
console.log(err);
65+
});
66+
});
67+
```
68+
69+
Impact:
70+
71+
- This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x, 25.x
72+
73+
Thank you, to dantt for reporting this vulnerability and thank you RafaelGSS for fixing it.
74+
75+
## Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466) - (Medium)
76+
77+
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors
78+
become uncatchable when `async_hooks.createHook()` is enabled.
79+
Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable.
80+
Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become
81+
vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
82+
83+
Impact:
84+
85+
- This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x, 25.x
86+
87+
Thank you, to Andrew MacPherson (AndrewMohawk) for identifying & aaron_vercel for reporting this vulnerability and thank you mcollina for fixing it.
88+
89+
## Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464) - (Medium)
90+
91+
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8
92+
without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`,
93+
each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated
94+
TLS connections. Over time this can lead to resource exhaustion and denial of service.
95+
96+
Impact:
97+
98+
- This vulnerability affects all users in active release lines: 20.x, 22.x, 24.x
99+
100+
Thank you, to giant_anteater for reporting this vulnerability and thank you RafaelGSS for fixing it.
101+
102+
## Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636) - (Medium)
103+
104+
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions
105+
when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs
106+
(such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch.
107+
This breaks the intended security boundary of the permission model and enables access to privileged local services,
108+
potentially leading to privilege escalation, data exposure, or local code execution.
109+
110+
In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
111+
112+
Impact:
113+
114+
- The issue affects users of the Node.js permission model on version v25.
115+
116+
Thank you, to mufeedvh for reporting this vulnerability and thank you RafaelGSS for fixing it.
117+
118+
## TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637) - (Medium)
119+
120+
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when
121+
`pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard
122+
TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file
123+
descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled
124+
input during the TLS handshake, a remote client can repeatedly trigger the issue.
125+
126+
Impact:
127+
128+
- This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks
129+
throw without being safely wrapped.
130+
131+
Thank you, to 0xmaxhax for reporting this vulnerability and thank you mcollina for fixing it.
132+
133+
## fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132) - (Low)
134+
135+
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed
136+
via `futimes()` even when the process has only read permissions.
21137

22-
## (Update 07-Jan-2026) Security Release postponed to January 8th
138+
Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file
139+
metadata can be modified in read-only directories. This behavior could be used to alter timestamps in
140+
ways that obscure activity, reducing the reliability of logs.
23141

24-
Our team decided to postpone the release to Thursday, January 8th, 2026,
25-
due to complications in the Node.js testing CI.
142+
Impact:
26143

27-
## (Update 17-Dec-2025) Security Release target January 7th
144+
- This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
28145

29-
We have decided to delay the release further to Wednesday, January 7th, 2026. Many of the
30-
downstream projects and users are on holiday break at the end of the year, and the security
31-
release will disclose the vulnerabilities being fixed as soon as the patches are available.
32-
We want to make sure that most users are no longer on holiday when they evaluate whether
33-
they are affected and need to perform time-sensitive upgrades.
146+
Thank you, to oriotie for reporting this vulnerability and thank you RafaelGSS for fixing it.
34147

35-
## (Update 15-Dec-2025) Security Release target December 18th
148+
## Downloads and release details
36149

37-
The team is still working on a particularly challenging patch, for this reason
38-
the release is being postponed to Thursday, December 18th or shortly after.
150+
- [Node.js v20.19.7](/blog/release/v20.19.7/)
151+
- [Node.js v22.21.2](/blog/release/v22.21.2/)
152+
- [Node.js v24.12.1](/blog/release/v24.12.1/)
153+
- [Node.js v25.2.2](/blog/release/v25.2.2/)
39154

40155
# Summary
41156

‎apps/site/site.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@
2828
],
2929
"websiteBanners": {
3030
"index": {
31-
"startDate": "2025-12-08T17:00:00.000Z",
32-
"endDate": "2026-01-13T23:00:00.000Z",
33-
"text": "New security releases to be made available Tuesday, January 13, 2026",
31+
"startDate": "2026-01-13T00:00:00.000Z",
32+
"endDate": "2026-01-20T00:00:00.000Z",
33+
"text": "January Security Release is available",
3434
"link": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
3535
"type": "warning"
3636
}

0 commit comments

Comments
 (0)