CVE-2025-23084: Path traversal by drive name in Windows environment
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.
On Windows, a path that does not start with the file separator is treated as relative to the current directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.6Fixed in 20.18.2Fixed in 22.13.1Fixed in 23.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.18.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.13.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.6.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-23084?
CVE-2025-23084 is classified as a high-severity vulnerability affecting Node.js in Windows environments.
How do I fix CVE-2025-23084?
To mitigate CVE-2025-23084, update Node.js to the latest security release provided by the Node.js team.
Which versions of Node.js are affected by CVE-2025-23084?
CVE-2025-23084 affects multiple versions of Node.js prior to the patch release that addresses the vulnerability.
What does CVE-2025-23084 impact in Node.js?
CVE-2025-23084 impacts the handling of drive names in Node.js on Windows, potentially leading to unintended file system access.
Can CVE-2025-23084 be exploited remotely?
CVE-2025-23084 can potentially be exploited remotely if an attacker can control the input to vulnerable Node.js functions.