A vulnerability has been identified in Node.js, specifically… (CVE-2025-23084)

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

On Windows, a path that does not start with the file separator is treated as relative to the current directory.

This vulnerability affects Windows users of path.join API.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.6"},{"introduced":"19.0.0"},{"fixed":"20.18.2"},{"introduced":"21.0.0"},{"fixed":"22.13.1"},{"introduced":"23.0.0"},{"fixed":"23.8.0"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.6"},{"introduced":"19.0.0"},{"fixed":"20.18.2"},{"introduced":"21.0.0"},{"fixed":"22.13.1"},{"introduced":"23.0.0"},{"fixed":"23.8.0"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2025-23084 nodejs Corrigé dans: 22.13.1-r0

Références

advisory nvd.nist.gov
advisory security.netapp.com
advisory github.com
web nodejs.org
web openwall.com