The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npmUpgrade nodejs-full-i18n | Feb 16, 2026 | Feb 10, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jan 21, 2026 | Jan 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-npmUpgrade nodejs22-libsUpgrade nodejs22-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs20Upgrade nodejs22-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs22-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs20-docsUpgrade nodejs20-debugsourceUpgrade nodejs20-debuginfoUpgrade nodejs24Upgrade nodejs24-npmUpgrade nodejs24-libsUpgrade nodejs22Upgrade nodejs22-docsUpgrade nodejs20-develUpgrade nodejs22-debuginfoUpgrade nodejs20-npmUpgrade nodejs20-libsUpgrade nodejs24-docsUpgrade nodejs24-debuginfoUpgrade v8-11.3-develUpgrade v8-12.4-develUpgrade v8-13.6-develUpgrade nodejs24-debugsourceUpgrade nodejs22-full-i18n | Feb 10, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade nodejs | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade nodejs24-full-i18nUpgrade nodejs-docsUpgrade nodejs24-libsUpgrade v8-12.4-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-develUpgrade nodejs24-npmUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs-libsUpgrade nodejs24-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-npmUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs24-devel | Feb 9, 2026 | Jan 20, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs24-libsUpgrade v8-13.6-develUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs24Upgrade nodejs-libsUpgrade nodejs24-develUpgrade nodejs22-debugsourceUpgrade nodejs24-npmUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejs24-docsUpgrade nodejs-nodemonUpgrade nodejs24-debuginfoUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade npm | Feb 6, 2026 | Jan 20, 2026 |
| Rocky_linux | — | Upgrade nodejs22-debuginfoUpgrade npmUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs22-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs-develUpgrade nodejs24-devel | Feb 9, 2026 | Feb 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub