CVE-2025-55131
Node.js: Buffer.alloc can return memory that is not zero-filled
Technology
Node.js
CVSS Score
7.1 / 10.0
Affected Versions
Node.js 20, 22, 24 and 25 before the January 2026 releases
Upstream Fix
20.20.0; 22.22.0; 24.13.0; 25.3.0
Published
January 20, 2026
OSSeva Coverage
Fixed upstream
Description
When the vm module's timeout option interrupts an allocation, buffers from Buffer.alloc and TypedArrays such as Uint8Array can contain leftover data, which can leak in-process secrets such as tokens or passwords. Rated High by Node.js. Fixed in 20.20.0, 22.22.0, 24.13.0 and 25.3.0.
Is your Node.js deployment affected?
If you're running Node.js 20, 22, 24 and 25 before the January 2026 releases, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js Node.js 20, 22, 24 and 25 before the January 2026 releases?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?