Description
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

On Windows, a path that does not start with the file separator is treated as relative to the current directory.

This vulnerability affects Windows users of `path.join` API.
Published: 2025-01-28
Score: 5.5 Medium
EPSS: 1.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3112 A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.
History

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Tue, 19 Aug 2025 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
Nodejs
Nodejs node.js
CPEs cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Nodejs
Nodejs node.js
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 8e-05}

 epss

{'score': 9e-05}

Tue, 28 Jan 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jan 2025 04:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.
References
Metrics cvssV3_0

{'score': 5.6, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N'}

Subscriptions

Microsoft Windows
Nodejs Node.js
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2025-11-04T21:09:38.409Z

Reserved: 2025-01-10T19:05:52.771Z

Link: CVE-2025-23084

cve-icon Vulnrichment

Updated: 2025-11-04T21:09:38.409Z

cve-icon NVD

Status : Modified

Published: 2025-01-28T05:15:11.267

Modified: 2025-11-04T22:16:07.090

Link: CVE-2025-23084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses