Node.js - January 2026 Security Releases

New critical vulnerabilities in Node.js

The Node.js team has released security updates for versions 25.x, 24.x, 22.x and 20.x, after some serious vulnerabilities were reported last December — only landing now, right around the holiday season.

In total, 8 issues are fixed: 3 high severity, 4 medium severity, and 1 low severity.

High severity vulnerabilities

• Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled (CVE-2025-55131)

• Bypass File System Permissions using crafted symlinks (CVE-2025-55130)

• Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)

Medium severity vulnerabilities

• Uncatchable “Maximum call stack size exceeded” error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)

• Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)

• Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) (CVE-2026-21636)

• TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak (CVE-2026-21637)

Low severity vulnerabilities

• fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

Downloads and release details

• Node.js 20.20.0

• Node.js 22.22.0

• Node.js 24.13.0

• Node.js 25.3.0

It’s worth noting that End-of-Life versions are always affected whenever a security release goes out. To keep your system secure, use a supported version as shown in Node.js’s release schedule.

If you’re interested in web-side security, I’ve also written a guide on how Content Security Policy works to protect your applications from malicious scripts.

And if you’re about to start a new Node.js backend, before picking your stack take a look at how to build a REST API with Fastify and TypeScript: keeping dependencies up to date doesn’t count for much if the APIs themselves poorly validate the input they receive.