PT-2025-4814 · Node.Js+1 · Node.Js+1

Taise · Published 2025-01-21 · Updated 2025-08-19 · CVE-2025-23084

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Node.js (affected versions not specified)

Description A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of the path.join API.

Recommendations As a temporary workaround, consider disabling the path.join API until a patch is available. Restrict access to the path.join function to minimize the risk of exploitation. Avoid using relative paths in the path.join API until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2025-1865

BDU:2025-10621

BIT-NODE-2025-23084

BIT-NODE-MIN-2025-23084

CVE-2025-23084

OESA-2025-1090

OESA-2025-1091

Affected Products

Alt Linux

Node.Js

References · 28

• https://nvd.nist.gov/vuln/detail/CVE-2025-23085 · Security Note
• https://osv.dev/vulnerability/BIT-node-2025-23084 · Vendor Advisory
• https://nodejs.org/en/blog/vulnerability/january-2025-security-releases · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23084 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10621 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23084 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-23084 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23084 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-min-2025-23084 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-23084 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-23084 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1090 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1091 · Vendor Advisory
• https://nodejs.org/en/blog/vulnerability/january-2025-security-releases#path-traversal-by-drive-name-in-windows-environment-cve-2025-23084---medium · Note
• https://t.me/cvenotify/108839 · Telegram Post