CVE-2025-23084

Summary

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

On Windows, a path that does not start with the file separator is treated as relative to the current directory.

This vulnerability affects Windows users of path.join API.

Affected Software

VendorProductVersion RangeStatus
NodeJSNode4.0 < 4.*affected
NodeJSNode5.0 < 5.*affected
NodeJSNode6.0 < 6.*affected
NodeJSNode7.0 < 7.*affected
NodeJSNode8.0 < 8.*affected
NodeJSNode9.0 < 9.*affected
NodeJSNode10.0 < 10.*affected
NodeJSNode11.0 < 11.*affected
NodeJSNode12.0 < 12.*affected
NodeJSNode13.0 < 13.*affected
NodeJSNode14.0 < 14.*affected
NodeJSNode15.0 < 15.*affected
NodeJSNode16.0 < 16.*affected
NodeJSNode17.0 < 17.*affected
NodeJSNode18.0 < 18.20.6affected
NodeJSNode19.0 < 19.*affected
NodeJSNode20.0 < 20.18.2affected
NodeJSNode21.0 < 21.*affected
NodeJSNode22.0 < 22.13.1affected
NodeJSNode23.0 < 23.6.1affected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References