CVE-2025-55131: A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module wit

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• nodejs node

  • 20.19.6 and later · up to and including 20.19.6affected · semver
  • 22.21.1 and later · up to and including 22.21.1affected · semver
  • 24.12.0 and later · up to and including 24.12.0affected · semver
  • 25.2.1 and later · up to and including 25.2.1affected · semver
  • 4.0 and later · before 4.*affected · semver
  • 5.0 and later · before 5.*affected · semver
  • 6.0 and later · before 6.*affected · semver
  • 7.0 and later · before 7.*affected · semver
  • 8.0 and later · before 8.*affected · semver
  • 9.0 and later · before 9.*affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2024-27983An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 f
  58Plan
• CVE-2025-27210An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.
  34Monitor
• CVE-2024-27980Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject a
  32Monitor

Published before and after this one in the same product

• ← EarlierCVE-2025-23167May 18, 2025 · A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.
  26Monitor
• ← EarlierCVE-2025-27209Jul 18, 2025 · The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash.
  30Monitor
• Later →CVE-2026-58040Jul 30, 2026 · An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomp
  25Monitor

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.