Node.js up to 25.2.1 uninitialized pointer

Summaryinfo

A vulnerability, which was classified as problematic, was found in Node.js. The affected element is an unknown function. Executing a manipulation can lead to uninitialized pointer. This vulnerability is handled as CVE-2025-55131. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Node.js. It has been declared as problematic. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. The CWE definition for the vulnerability is CWE-824. The product accesses or uses a pointer that has not been initialized. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.

The advisory is available at nodejs.org. This vulnerability was named CVE-2025-55131 since 08/07/2025. The exploitation appears to be difficult. The attack can be initiated remotely. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 296677 (SUSE SLES15 / openSUSE 15 Security Update : nodejs22 (SUSE-SU-2026:0295-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (296677) and CERT Bund (WID-SEC-2026-0098). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• Open Source Node.js

Productinfo

Type

• JavaScript Library

Name

• Node.js

Version

• 4.x
• 5.x
• 6.x
• 7.x
• 8.x
• 9.x
• 10.x
• 11.x
• 12.x
• 13.x
• 14.x
• 15.x
• 16.x
• 17.x
• 18.x
• 20.19.0
• 20.19.1
• 20.19.2
• 20.19.3
• 20.19.4
• 20.19.5
• 20.19.6
• 22.21.0
• 22.21.1
• 24.0
• 24.1
• 24.2
• 24.3
• 24.4
• 24.5
• 24.6
• 24.7
• 24.8
• 24.9
• 24.10
• 24.11
• 24.12.0
• 25.2.0
• 25.2.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion