CVE-2025-55130 in Node.js 22.16.0

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20,

Severity

Critical 9.1

Exploitation

2% chance of exploit
in the next 30 days

Fix

Update to 22.22.0, 24.13.0, 25.3.0

Where

App / API

How it matched

Exact version match

First seen

2026-11-05 01:13:58 UTC

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-55130