CVE-2025-27210: Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.19.4Fixed in 22.17.1Fixed in 24.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.19.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.17.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.4.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-27210?
CVE-2025-27210 has a moderate severity rating due to its potential impact on Windows users.
How do I fix CVE-2025-27210?
To fix CVE-2025-27210, it is recommended to update to the latest version of Node.js that addresses this vulnerability.
Who is affected by CVE-2025-27210?
CVE-2025-27210 primarily affects Windows users utilizing the Node.js `path.join` API.
What are the consequences of CVE-2025-27210?
Exploiting CVE-2025-27210 may allow attackers to conduct file path manipulations leading to unintended behavior in applications.
Is there a workaround for CVE-2025-27210?
As of now, it is advised to avoid using the vulnerable `path.join` API with Windows device names until a proper fix is implemented.