{
  "cve": [
    "CVE-2025-55131"
  ],
  "vulnerable": "20.x || 22.x || 24.x || 25.x",
  "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0",
  "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
  "description": "Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled",
  "overview": "A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "high"
}