UpHeron
All vulnerabilities

Servers and applications

CVE-2025-23084

Path traversal by drive name in Windows environment

Severity
Medium 5.5
Published
21 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
18.20.6, 20.18.2, 22.13.1, 23.6.1
Sources
NVD, nodejs

Description

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 18.0.0 before 18.20.6
  • From 20.0.0 before 20.18.2
  • From 22.0.0 before 22.13.1
  • From 23.0.0 before 23.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-23084
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-23084
  • Node.js security release https://nodejs.org/en/blog/vulnerability/january-2025-security-releases