CVE-2025-23084
- Source
- https://cve.org/CVERecord?id=CVE-2025-23084
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23084.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-23084
- Aliases
- Downstream
- Related
- Published
- 2025-01-28T04:35:15.236Z
- Modified
- 2026-07-15T01:49:11.503544123Z
- Severity
-
- 5.6 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.
On Windows, a path that does not start with the file separator is treated as relative to the current directory.
This vulnerability affects Windows users of
path.joinAPI. - Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "introduced": "4.0" }, { "fixed": "4.*" }, { "introduced": "5.0" }, { "fixed": "5.*" }, { "introduced": "6.0" }, { "fixed": "6.*" }, { "introduced": "7.0" }, { "fixed": "7.*" }, { "introduced": "8.0" }, { "fixed": "8.*" }, { "introduced": "9.0" }, { "fixed": "9.*" }, { "introduced": "10.0" }, { "fixed": "10.*" }, { "introduced": "11.0" }, { "fixed": "11.*" }, { "introduced": "12.0" }, { "fixed": "12.*" }, { "introduced": "13.0" }, { "fixed": "13.*" }, { "introduced": "14.0" }, { "fixed": "14.*" }, { "introduced": "15.0" }, { "fixed": "15.*" }, { "introduced": "16.0" }, { "fixed": "16.*" }, { "introduced": "17.0" }, { "fixed": "17.*" }, { "introduced": "18.0" }, { "fixed": "18.20.6" }, { "introduced": "19.0" }, { "fixed": "19.*" }, { "introduced": "20.0" }, { "fixed": "20.18.2" }, { "introduced": "21.0" }, { "fixed": "21.*" }, { "introduced": "22.0" }, { "fixed": "22.13.1" }, { "introduced": "23.0" }, { "fixed": "23.6.1" } ], "source": "AFFECTED_FIELD" } ], "cna_assigner": "hackerone", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23084.json" }- References
-
- http://www.openwall.com/lists/oss-security/2025/07/22/2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23084.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-23084
- https://security.netapp.com/advisory/ntap-20250321-0003/
- https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Affected packages
Git / github.com/nodejs/node
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "extracted_events": [ { "introduced": "18.0" }, { "fixed": "18.20.6" }, { "introduced": "20.0" }, { "fixed": "20.18.2" }, { "introduced": "22.0" }, { "fixed": "22.13.1" }, { "introduced": "23.0" }, { "fixed": "23.6.1" } ], "source": "CPE_RANGE" }
Affected versions
v18.*
v18.0.0
v18.1.0
v18.10.0
v18.11.0
v18.12.0
v18.12.1
v18.13.0
v18.14.0
v18.14.1
v18.14.2
v18.15.0
v18.16.0
v18.16.1
v18.17.0
v18.17.1
v18.18.0
v18.18.1
v18.18.2
v18.19.0
v18.19.1
v18.2.0
v18.20.0
v18.20.1
v18.20.2
v18.20.3
v18.20.4
v18.20.5
v18.3.0
v18.4.0
v18.5.0
v18.6.0
v18.7.0
v18.8.0
v18.9.0
v18.9.1
v20.*
v20.0.0
v20.1.0
v20.10.0
v20.11.0
v20.11.1
v20.12.0
v20.12.1
v20.12.2
v20.13.0
v20.13.1
v20.14.0
v20.15.0
v20.15.1
v20.16.0
v20.17.0
v20.18.0
v20.18.1
v20.2.0
v20.3.0
v20.3.1
v20.4.0
v20.5.0
v20.5.1
v20.6.0
v20.6.1
v20.7.0
v20.8.0
v20.8.1
v20.9.0
v22.*
v22.0.0
v22.1.0
v22.10.0
v22.11.0
v22.12.0
v22.13.0
v22.2.0
v22.3.0
v22.4.0
v22.4.1
v22.5.0
v22.5.1
v22.6.0
v22.7.0
v22.8.0
v22.9.0
v23.*
v23.0.0
v23.1.0
v23.2.0
v23.3.0
v23.4.0
v23.5.0
v23.6.0