PT-2025-29688

CVE-2025-27210

Published

2025-07-15

Updated

2026-10-31

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 20.19.4 through 24.4.1

Description A path traversal vulnerability exists in Node.js when running on Microsoft Windows. The path.normalize() function fails to block Windows device names such as CON, PRN, and AUX, allowing attackers to exploit this behavior for path traversal attacks. The vulnerability leverages the specific way Windows handles reserved device filenames.

Recommendations Node.js versions prior to 20.19.4 should be updated. Node.js versions prior to 22.17.1 should be updated. Node.js versions prior to 24.4.1 should be updated.

Exploitability

Exploit

Fix

Impacts

Researchers

Oblivionsage

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2025-27210