CVE-2025-23084
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functio...
Original description
The description as published by the source.
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.
On Windows, a path that does not start with the file separator is treated as relative to the current directory.
This vulnerability affects Windows users of path.join API.
Affected packages
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.6"},{"introduced":"19.0.0"},{"fixed":"20.18.2"},{"introduced":"21.0.0"},{"fixed":"22.13.1"},{"introduced":"23.0.0"},{"fixed":"23.8.0"}]}]
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.6"},{"introduced":"19.0.0"},{"fixed":"20.18.2"},{"introduced":"21.0.0"},{"fixed":"22.13.1"},{"introduced":"23.0.0"},{"fixed":"23.8.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2025-23084 nodejs Fixed in: 22.13.1-r0
References
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web nodejs.org
- web openwall.com