Log in Start free

Vulnerability · Published Jan 28, 2025 · Assigned by hackerone

CVE-2025-23084

Medium 5.6

In plain English

A medium-severity path traversal in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)5.6Medium
Exploit odds (30 days)1.6%top 24.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22nodejs22.13.1-r0ALPINE-CVE-2025-23084
Alpine:v3.23nodejs22.13.1-r0ALPINE-CVE-2025-23084
Alpine:v3.24nodejs22.13.1-r0ALPINE-CVE-2025-23084

Affected products (as reported)

VendorProductVersions
NodeJS Node 4.0 – before 4.*5.0 – before 5.*6.0 – before 6.*7.0 – before 7.*8.0 – before 8.*9.0 – before 9.*10.0 – before 10.*11.0 – before 11.*

Weakness: CWE-22 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

References