Riskcovery

CVE-2025-27210

State
Published
Severity
7.5 High
Published
Jul 18, 2025
Updated
Nov 4, 2025
Reserved
Feb 20, 2025

Read the record on cve.org

Description

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.

This vulnerability affects Windows users of `path.join` API.

Scores

CVSSScoreVectorSource
3.07.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nhackerone

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
nodenodejs
  • 20.0.0 to before 20.19.4Affected
  • 22.0.0 to before 22.17.1Affected
  • 24.0.0 to before 24.4.1Affected
nodejsnodejs
  • 4.0 to before 4.*Affected
  • 5.0 to before 5.*Affected
  • 6.0 to before 6.*Affected
  • 7.0 to before 7.*Affected
  • 8.0 to before 8.*Affected
  • 9.0 to before 9.*Affected
  • 10.0 to before 10.*Affected
  • 11.0 to before 11.*Affected
  • 12.0 to before 12.*Affected
  • 13.0 to before 13.*Affected
  • 14.0 to before 14.*Affected
  • 15.0 to before 15.*Affected
  • 16.0 to before 16.*Affected
  • 17.0 to before 17.*Affected
  • 18.0 to before 18.*Affected
  • 19.0 to before 19.*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.