CVE-2025-23084

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/07/22/2
https://security.netapp.com/advisory/ntap-20250321-0003/

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:nodejs:node.js:::::-:::*
	cpe:2.3:a:nodejs:node.js:::::-:::*
	cpe:2.3:a:nodejs:node.js:::::-:::*
	cpe:2.3:a:nodejs:node.js:::::-:::*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-01-28 05:15

Updated : 2025-11-04 22:16

NVD link : CVE-2025-23084

Mitre link : CVE-2025-23084

CVE.ORG link : CVE-2025-23084

JSON object : View

Products Affected

microsoft

windows

nodejs

node.js

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-23084", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.3}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-01-28T05:15:11.267", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}, {"url": "http://www.openwall.com/lists/oss-security/2025/07/22/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20250321-0003/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.\r\n\r\nOn Windows, a path that does not start with the file separator is treated as relative to the current directory. \r\n\r\nThis vulnerability affects Windows users of `path.join` API."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Node.js que afecta espec\u00edficamente a la gesti\u00f3n de nombres de unidades en el entorno Windows. Algunas funciones de Node.js no tratan los nombres de unidades como especiales en Windows. Como resultado, aunque Node.js asume una ruta relativa, en realidad hace referencia al directorio ra\u00edz. En Windows, una ruta que no comienza con el separador de archivos se trata como relativa al directorio actual. Esta vulnerabilidad afecta a los usuarios de Windows de la API `path.join`."}], "lastModified": "2025-11-04T22:16:07.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "45318EFE-37E9-464A-9030-CA2EE2992573", "versionEndExcluding": "18.20.6", "versionStartIncluding": "18.0"}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "9F4B1228-6F93-4D5E-AEE8-9233855A6B7A", "versionEndExcluding": "20.18.2", "versionStartIncluding": "20.0"}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "D4403A45-58F3-44F8-9DE2-05A1A4B449B5", "versionEndExcluding": "22.13.1", "versionStartIncluding": "22.0"}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "44BC2512-4267-437B-B2A3-C62A9296BE26", "versionEndExcluding": "23.6.1", "versionStartIncluding": "23.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "support@hackerone.com"}