p PatchFirst

ALPINE-CVE-2025-55130

ALPINE-CVE-2025-55130

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

CVSS 9.1 · Critical · Fix available

Published
Updated

Stack: system

Affected products and versions

  • nodejs Alpine:v3.21

    Affected ranges
    • ECOSYSTEM: < 22.22.2-r0

    Update to 22.22.2-r0

  • nodejs Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: < 22.22.0-r0

    Update to 22.22.0-r0

  • nodejs Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: < 24.13.0-r0

    Update to 24.13.0-r0

  • nodejs Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: < 24.13.0-r0

    Update to 24.13.0-r0

Original sources

Check your server →