Critical Node.js Security Update: January 2026 Vulnerability Report

The Node.js Project has released a critical security update on January 13, 2026, addressing eight distinct vulnerabilities across all active release lines. These updates affect Node.js 20.x, 22.x, 24.x, and 25.x. With three high-severity issues identified, failing to patch your environment could lead to unauthorized data access, sensitive memory leaks, and server crashes.

TL;DR for Decision-Makers: Update to the latest Node.js versions (v20.20.0, v22.22.0, v24.13.0, or v25.3.0) immediately. This release mitigates risks that could compromise your infrastructure's integrity and availability. Proactive patching reduces potential downtime and prevents the "security debt" that often leads to costly emergency remediations.

The High-Severity Risks: Memory Leaks and Permission Bypasses

This security release highlights several critical flaws that strike at the heart of the Node.js runtime and its permission model.

1. Memory Leaks via Race Conditions (CVE-2025-55131)

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc or Uint8Array may contain leftover data from previous operations.

• Risk: Sensitive data like API tokens, passwords, or PII can leak into process memory.
• Impact: Remotely exploitable if untrusted input influences workload and timeouts.

2. File System Permission Bypass (CVE-2025-55130)

Node.js's experimental Permission Model was found to have a flaw allowing attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symbolic links.

• Risk: A script granted access only to a specific directory can escape its sandbox and read/write arbitrary files on the system.
• Impact: Potential full system compromise for applications relying on Node.js native permission flags.

3. HTTP/2 Server Crashes (CVE-2025-59465)

A malformed HTTP/2 HEADERS frame with invalid HPACK data can trigger an unhandled TLSSocket error (ECONNRESET), causing the entire Node.js process to crash instead of safely closing the connection.

• Risk: Remote Denial of Service (DoS).
• Impact: Affects all applications running HTTP/2 without explicit error handlers on secure sockets.

Medium and Low Severity Vulnerabilities

Beyond the high-severity threats, several other issues were addressed:

• CVE-2025-59466 (Medium): Uncatchable "Maximum call stack size exceeded" errors via async_hooks leading to unrecoverable process crashes.
• CVE-2025-59464 (Medium): A memory leak in OpenSSL integration when processing TLS client certificates. Repeated connections can lead to resource exhaustion.
• CVE-2026-21636 (Medium): Permission model bypass via unchecked Unix Domain Socket (UDS) connections.
• CVE-2026-21637 (Medium): Exceptions in TLS PSK/ALPN callbacks bypassing error handlers, causing DoS and file descriptor leaks.
• CVE-2025-55132 (Low): fs.futimes() bypassing the read-only permission model, allowing modification of file timestamps.

Business Impact: The Bottom Line

Security vulnerabilities are more than just technical bugs; they are business risks.

1. Uptime Assurance: CVE-2025-59465 (HTTP/2 crash) can be used to bring down production services with minimal effort. Ensuring your servers are patched is the first step in guaranteeing 99.9% availability.
2. Data Confidentiality: The vm module memory leak (CVE-2025-55131) poses a direct threat to data privacy, which can result in regulatory fines (GDPR, CCPA) if sensitive information is exposed.
3. Maintenance Efficiency: Staying on top of security releases reduces "emergency patching" overhead. Teams that integrate security updates into their regular CI/CD cycles reduce their technical debt and improve overall Time to Market (TTM) by avoiding major security-related interruptions.

Action Plan: How to Secure Your Applications

To protect your infrastructure, follow these steps:

1. Verify Your Current Version

Check which version of Node.js your production environment is running:

node -v

2. Upgrade to the Latest Release

Depending on your release line, upgrade to at least:

• Node.js 25.3.0 (Latest)
• Node.js 24.13.0
• Node.js 22.22.0 (Active LTS)
• Node.js 20.20.0 (Maintenance LTS)

3. Implement Proper Error Handling

For applications using HTTP/2 or HTTPS, ensure you have explicit error listeners to prevent crashes from unhandled socket errors:

server.on("secureConnection", (socket) => {
	socket.on("error", (err) => {
		// Log the error without crashing the process
		console.error("Socket error:", err);
	});
});

Conclusion

The January 2026 Node.js security release is a reminder of the evolving threat landscape in modern web development. By addressing these eight vulnerabilities, the Node.js team has provided the tools necessary to keep your applications secure. Update your environments today to ensure your business remains resilient against potential exploits.

---

For more information, refer to the official Node.js security release announcement.