Vulnerability Description
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 18.0, < 18.20.6 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- https://nodejs.org/en/blog/vulnerability/january-2025-security-releasesVendor Advisory
- http://www.openwall.com/lists/oss-security/2025/07/22/2
- https://security.netapp.com/advisory/ntap-20250321-0003/
FAQ
What is CVE-2025-23084?
CVE-2025-23084 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows....
How severe is CVE-2025-23084?
CVE-2025-23084 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-23084?
Check the references section above for vendor advisories and patch information. Affected products include: Nodejs Node.Js, Microsoft Windows.