CVE-2025-23084

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment

Medium · published January 28, 2025

CVSS v3.0
5.6
EPSS
2%
Percentile
75.4
In the wild
Unconfirmed
What it is

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

On Windows, a path that does not start with the file separator is treated as relative to the current directory.

This vulnerability affects Windows users of `path.join` API.

The record
Technical detail
CVSS v3.0
5.6 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01585 · 75.4th percentile
Published
2025-01-28T04:35Z
EPSS history
Timeline
  • 28 JAN 04:35Z
    A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment
    cvelistv5