Skip to content
CVE PROGRAM SOURCE RECORD5.6 Medium

CVE-2025-23084

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NodeJS Node

Default version status: unaffected

  • 4.0 to < 4.*affected
  • 5.0 to < 5.*affected
  • 6.0 to < 6.*affected
  • 7.0 to < 7.*affected
  • 8.0 to < 8.*affected
  • 9.0 to < 9.*affected
  • 10.0 to < 10.*affected
  • 11.0 to < 11.*affected
  • 12.0 to < 12.*affected
  • 13.0 to < 13.*affected
  • 14.0 to < 14.*affected
  • 15.0 to < 15.*affected
  • 16.0 to < 16.*affected
  • 17.0 to < 17.*affected
  • 18.0 to < 18.20.6affected
  • 19.0 to < 19.*affected
  • 20.0 to < 20.18.2affected
  • 21.0 to < 21.*affected
  • 22.0 to < 22.13.1affected
  • 23.0 to < 23.6.1affected

References