CVE-2025-23084

Published: Jan 28, 2025Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

Affected (4)

Products: Nodejs: Node.js

1 product

Configuration A

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nodejs Node.js	From 18.0 to 18.20.6
Nodejs Node.js	From 20.0 to 20.18.2
Nodejs Node.js	From 22.0 to 22.13.1
Nodejs Node.js	From 23.0 to 23.6.1

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://nodejs.org/en/blog/vulnerability/january-2025-security-releases

Source: support@hackerone.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/07/22/2

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20250321-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.