CVE-2025-23084 : faille moyenne nodejs node.js (CVSS 5.5)

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

Sévérité

Moyenne (CVSS 5.5)

Vecteur CVSS

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitation active

Non signalée par la CISA

Publication

28 janv. 2025

Dernière mise à jour

17 juin 2026

• nodejs node.js

• Fiche CVE-2025-23084 sur le NVD (NIST)
• nodejs.org/en/blog/vulnerability/january…
• openwall.com/lists/oss-security/2025/07/22/2
• security.netapp.com/advisory/ntap-20250321-0003/