TI-2025-20067 Aliases CVE-2025-27210 GHSA-x33r-pvvq-wjrh

Path traversal in NodeJS node

MEDIUM 54CWE-22Published 2025-07-18 · Updated 2025-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.14338 96th percentileScored 2026-11-07

Fix Fixed node (nodejs): 20.19.4, 22.17.1, 24.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NodeJS	node	20.0.0 to before 20.19.4; 22.0.0 to before 22.17.1; 24.0.0 to before 24.4.1	20.19.4, 22.17.1, 24.4.1	Patch available	CNA
NodeJS	nodejs	4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 and later; 19.0 and later	—	No fix listed	CNA

node VendorNodeJS Affected 20.0.0 to before 20.19.4; 22.0.0 to before 22.17.1; 24.0.0 to before 24.4.1 Fixed in 20.19.4, 22.17.1, 24.4.1 Patch available CNA
nodejs VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 and later; 19.0 and later Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nodejs:node.js::::::::	—	—	NodeJS

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* Versions — — ·NodeJS

Remediation

Fix · CNA node (nodejs) Fixed in 20.19.4, 22.17.1, 24.4.1

Timeline

2026-10-02 Threatist record created from CVE-2025-27210
2026-10-03 Alias added: GHSA-x33r-pvvq-wjrh

References

Other 1

https://nodejs.org/en/blog/vulnerability/july-2025-security-releases

TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5

See all 295 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences