HIGHFixed upstream

CVE-2025-27210

Node.js: Windows device names bypass path traversal protection

Technology

Node.js

CVSS Score

7.5 / 10.0

Affected Versions

Node.js 20, 22 and 24 on Windows before the July 2025 releases

Upstream Fix

20.19.4; 22.17.1; 24.4.1

Published

July 18, 2025

OSSeva Coverage

Fixed upstream

Description

An incomplete fix for CVE-2025-23084: Windows device names such as CON, PRN and AUX bypass the path traversal protection in path.normalize() and affect users of path.join on Windows. Rated High by Node.js. Fixed in 20.19.4, 22.17.1 and 24.4.1.

Upstream record: NVD · CVE.org

Is your Node.js deployment affected?

If you're running Node.js 20, 22 and 24 on Windows before the July 2025 releases, you need this patch. Book a discovery call to get covered.

Book a discovery call View Node.js coverage →

Get a quote

Running Node.js Node.js 20, 22 and 24 on Windows before the July 2025 releases?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Node.js support