A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- CVSS 3.0 Base Score: 2.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-packagingUpgrade v8-13.6-devel | Feb 16, 2026 | Feb 10, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jan 21, 2026 | Jan 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-develUpgrade nodejs22-npmUpgrade nodejs24-libsUpgrade nodejs20-full-i18nUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs22-libsUpgrade nodejs20Upgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs20-docsUpgrade nodejs22-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs24Upgrade nodejs24-docsUpgrade v8-12.4-develUpgrade nodejs22-docsUpgrade nodejs22Upgrade nodejs20-libsUpgrade v8-13.6-develUpgrade nodejs22-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs20-develUpgrade nodejs20-npmUpgrade v8-11.3-develUpgrade nodejs24-debugsource | Feb 10, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade nodejs | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs24-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs24-docsUpgrade nodejs-full-i18nUpgrade nodejs-npmUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs24-npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade v8-13.6-devel | Feb 9, 2026 | Jan 20, 2026 |
| Redhat_linux | — | Upgrade nodejs24-debuginfoUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs24-docsUpgrade nodejs-npmUpgrade nodejs22-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs-debuginfoUpgrade nodejs24-npmUpgrade nodejs22-debugsourceUpgrade nodejsUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs24-full-i18nUpgrade nodejs24-debugsource | Feb 6, 2026 | Jan 20, 2026 |
| Rocky_linux | — | Upgrade nodejs24Upgrade nodejs24-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs24-debugsourceUpgrade nodejs24-develUpgrade nodejsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-libsUpgrade npmUpgrade nodejs24-debuginfoUpgrade nodejs-npmUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | Feb 9, 2026 | Feb 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub