CVE-2025-55132

描述

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

如何修補 CVE-2025-55132

要修補 CVE-2025-55132,請將受影響套件升級到下列已修補版本。

• —升級至 22.22.2-r0 或更新版本
• —升級至 20.20.0 或更新版本
• —升級至 20.20.0 或更新版本
• —升級至 20.19.2+dfsg-1+deb13u1 或更新版本

CVE-2025-55132 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 22.22.2-r0
• >= 20.0.0, < 20.20.0, >= 21.0.0, < 22.22.0, >= 23.0.0, < 24.13.0, >= 25.0.0, < 25.3.0
• >= 20.0.0, < 20.20.0, >= 21.0.0, < 22.22.0, >= 23.0.0, < 24.13.0, >= 25.0.0, < 25.3.0
• from 0, < 20.19.2+dfsg-1+deb13u1

CVSS 分數

參考連結(4)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-55132
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2025-55132
• WEBnodejs.org/en/blog/vulnerability/december-2025-security-releases
• WEBnvd.nist.gov/vuln/detail/CVE-2025-55132