# Node.js - January 2026 Security Releases

> Security updates for Node.js 25.x, 24.x, 22.x and 20.x: 3 high-severity vulnerabilities, 4 medium and 1 low. Here is what they fix and how to update.

- Autore / Author: Diego Betto (https://diegobetto.com/about/)
- Pubblicato / Published: 2026-01-15
- URL: https://diegobetto.com/en/nodejs-security-releases-january-2026/
- Tag: javascript, security

## New critical vulnerabilities in Node.js

The Node.js team has released security updates for versions **25.x, 24.x, 22.x and 20.x**, after some serious vulnerabilities were reported last December — only landing now, right around the holiday season.

In total, 8 issues are fixed: 3 high severity, 4 medium severity, and 1 low severity.

### High severity vulnerabilities

- [Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#timeout-based-race-conditions-make-uint8arraybufferalloc-non-zerofilled-cve-2025-55131---high)
- [Bypass File System Permissions using crafted symlinks (CVE-2025-55130)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#bypass-file-system-permissions-using-crafted-symlinks-cve-2025-55130---high)
- [Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#nodejs-http2-server-crashes-with-unhandled-error-when-receiving-malformed-headers-frame-cve-2025-59465---high)

### Medium severity vulnerabilities

- [Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#uncatchable-maximum-call-stack-size-exceeded-error-on-nodejs-via-async_hooks-leads-to-process-crashes-bypassing-error-handlers-cve-2025-59466---medium)
- [Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#memory-leak-that-enables-remote-denial-of-service-against-applications-processing-tls-client-certificates-cve-2025-59464---medium)
- [Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#nodejs-permission-model-bypass-via-unchecked-unix-domain-socket-connections-uds-cve-2026-21636---medium)
- [TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium)

### Low severity vulnerabilities

- [fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#fsfutimes-bypasses-read-only-permission-model-cve-2025-55132---low)

## Downloads and release details

<ul>
  <li>
    [Node.js 20.20.0](https://nodejs.org/en/blog/release/v20.20.0/)
  </li>
  <li>
    [Node.js 22.22.0](https://nodejs.org/en/blog/release/v22.22.0/)
  </li>
  <li>
    [Node.js 24.13.0](https://nodejs.org/en/blog/release/v24.13.0/)
  </li>
  <li>
    [Node.js 25.3.0](https://nodejs.org/en/blog/release/v25.3.0/)
  </li>
</ul>

It's worth noting that End-of-Life versions are always affected whenever a security release goes out. To keep your system secure, use a supported version as shown in Node.js's [release schedule](https://github.com/nodejs/release#release-schedule).

If you're interested in web-side security, I've also written a guide on how [Content Security Policy](https://diegobetto.com/csp-content-security-policy/) works to protect your applications from malicious scripts.

And if you're about to start a new Node.js backend, before picking your stack take a look at how to [build a REST API with Fastify and TypeScript](https://diegobetto.com/fastify-rest-api-typescript/): keeping dependencies up to date doesn't count for much if the APIs themselves poorly validate the input they receive.