"The Node.js project has released a coordinated security update affecting all active release lines: 25.x, 24.x, 22.x, and 20.x. This release addresses multiple vulnerabilities across the Node.js runtime, including high-, medium-, and low-severity issues. The fixes span core areas such as memory handling, permission enforcement, protocol processing, TLS error paths, and resource management. While no new features are introduced, this update is critical for teams running Node.js in production-particularly in network-facing or high-concurrency environments."
"This vulnerability was caused by a race condition in Node.js buffer allocation under specific timing scenarios. Performance optimizations reduced or deferred memory zero-initialization, which-under interruption (such as vm with the timeout option) or concurrent execution-could allow a buffer to become observable before its memory was fully initialized. When this occurred, buffers created via Buffer.alloc() or TypedArray constructors could contain residual data from previous allocations, breaking the expectation of zero-filled memory and potentially exposing in-process secrets."
"Node.js now enforces strict memory initialization before exposing buffers to userland. Allocation and exposure are no longer interleaved, eliminating the timing window where partially initialized memory could be observed. This restores deterministic and safe buffer semantics even under timeouts or concurrency. How do I know if this affects me? You may be affected if your application allocates buffers using Buffer.alloc() or TypedArray constructors and exposes their contents-directly or indirectly-through remote interfaces such as HTTP APIs, RPC handlers, or streaming endpoints."
A coordinated security update addresses vulnerabilities across Node.js 25.x, 24.x, 22.x, and 20.x, including high-, medium-, and low-severity issues. Fixes target core areas such as memory handling, permission enforcement, protocol processing, TLS error paths, and resource management. A high-severity buffer initialization race (CVE-2025-55131) could allow buffers created by Buffer.alloc() or TypedArray constructors to be observed before zero-initialization completed, exposing residual in-process data. Node.js now enforces strict memory initialization before exposing buffers, removing the allocation/exposure timing window. Applications that expose buffer contents via HTTP APIs, RPC handlers, or streaming endpoints face higher risk, especially under concurrency or timeouts.
Read at The NodeSource Blog - Node.js Tutorials, Guides, and Updates
Unable to calculate read time
Collection
[
|
...
]