5.6

CVE-2025-23084: nodejs node Path Traversal

CVSS: 5.6v3.0MediumModified
AliasesALPINE-CVE-2025-23084CGA-2vjv-26qj-24r7CGA-c8wg-vvpf-jj86
Published 28-01-2025Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2025-23084 is a medium (CVSS 5.6) Path Traversal vulnerability in nodejs node. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.1% of scored vulnerabilities.

Overall risk
23/100
0100
Low · default modelHow is this calculated?
CVSS score
5.6/10
010
Medium · v3.0 (CVE.org)
EPSS score
1.58%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-RHVV-3WV7-PRFHUBUNTU-CVE-2025-23084

Timeline

  1. 28-01-2025
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

1.58%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.58% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard2 products
  • nodejs-16< 16.20.2-r16
  • nodejs-21< 21.7.3-r13
Nodejs2 products
  • node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.* | ≥ 17.0, < 17.* | ≥ 18.0, < 18.20.6 | ≥ 19.0, < 19.* | ≥ 20.0, < 20.18.2 | ≥ 21.0, < 21.* | ≥ 22.0, < 22.13.1 | ≥ 23.0, < 23.6.1
  • node.js≥ 18.0, < 18.20.6 | ≥ 20.0, < 20.18.2 | ≥ 22.0, < 22.13.1 | ≥ 23.0, < 23.6.1
Wolfi2 products
  • nodejs-16< 16.20.2-r16
  • nodejs-21< 21.7.3-r13
Alpine1 product
  • nodejs< 22.13.1-r0

4 vendors · 7 products

References

6 links