Vulnerability Details CVE-2025-23084
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.
On Windows, a path that does not start with the file separator is treated as relative to the current directory.
This vulnerability affects Windows users of `path.join` API.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 10.8%
CVSS Severity
CVSS v3 Score 5.6
Products affected by CVE-2025-23084
-
cpe:2.3:a:nodejs:node.js:18.0.0
-
cpe:2.3:a:nodejs:node.js:18.0.1
-
cpe:2.3:a:nodejs:node.js:18.0.2
-
cpe:2.3:a:nodejs:node.js:18.0.3
-
cpe:2.3:a:nodejs:node.js:18.0.4
-
cpe:2.3:a:nodejs:node.js:18.0.5
-
cpe:2.3:a:nodejs:node.js:18.0.6
-
cpe:2.3:a:nodejs:node.js:18.1.0
-
cpe:2.3:a:nodejs:node.js:18.10.0
-
cpe:2.3:a:nodejs:node.js:18.11.0
-
cpe:2.3:a:nodejs:node.js:18.16.1
-
cpe:2.3:a:nodejs:node.js:18.17.0
-
cpe:2.3:a:nodejs:node.js:18.2.0
-
cpe:2.3:a:nodejs:node.js:18.3.0
-
cpe:2.3:a:nodejs:node.js:18.4.0
-
cpe:2.3:a:nodejs:node.js:18.5.0
-
cpe:2.3:a:nodejs:node.js:18.6.0
-
cpe:2.3:a:nodejs:node.js:18.7.0
-
cpe:2.3:a:nodejs:node.js:18.8.0
-
cpe:2.3:a:nodejs:node.js:18.9.0
-
cpe:2.3:a:nodejs:node.js:18.9.1
-
cpe:2.3:a:nodejs:node.js:20.0.0
-
cpe:2.3:a:nodejs:node.js:20.1.0
-
cpe:2.3:a:nodejs:node.js:20.2.0
-
cpe:2.3:a:nodejs:node.js:20.3.0
-
cpe:2.3:a:nodejs:node.js:20.3.1
-
cpe:2.3:a:nodejs:node.js:20.4.0
-
cpe:2.3:a:nodejs:node.js:20.5.0
-
cpe:2.3:a:nodejs:node.js:20.5.1
-
cpe:2.3:a:nodejs:node.js:20.6.0
-
cpe:2.3:a:nodejs:node.js:20.6.1
-
cpe:2.3:a:nodejs:node.js:20.7.0
-
cpe:2.3:a:nodejs:node.js:20.8.0
-
cpe:2.3:a:nodejs:node.js:20.8.1
-
cpe:2.3:a:nodejs:node.js:22.0.0
-
cpe:2.3:a:nodejs:node.js:22.1.0
-
cpe:2.3:a:nodejs:node.js:22.10.0
-
cpe:2.3:a:nodejs:node.js:22.2.0
-
cpe:2.3:a:nodejs:node.js:22.3.0
-
cpe:2.3:a:nodejs:node.js:22.4.0
-
cpe:2.3:a:nodejs:node.js:22.4.1
-
cpe:2.3:a:nodejs:node.js:22.5.0
-
cpe:2.3:a:nodejs:node.js:22.5.1
-
cpe:2.3:a:nodejs:node.js:22.6.0
-
cpe:2.3:a:nodejs:node.js:22.7.0
-
cpe:2.3:a:nodejs:node.js:22.8.0
-
cpe:2.3:a:nodejs:node.js:22.9.0
-
cpe:2.3:a:nodejs:node.js:23.0.0
-
cpe:2.3:a:nodejs:node.js:23.1.0
-
cpe:2.3:a:nodejs:node.js:23.2.0
-
cpe:2.3:a:nodejs:node.js:23.3.0
-
cpe:2.3:a:nodejs:node.js:23.4.0
-
cpe:2.3:a:nodejs:node.js:23.5.0
-
cpe:2.3:a:nodejs:node.js:23.6.0
-
cpe:2.3:o:microsoft:windows:-