CVE-2025-23084

What it actually does

Node.js path.join on Windows fails to treat drive names (e.g., C:) as absolute, causing a path that appears relative to be resolved against the filesystem root instead of the current working directory.

Why it matters to the business

Windows applications using Node.js may expose files outside intended directories, increasing risk of data disclosure or tampering on affected systems; low EPSS and lack of KEV listing indicate limited observed exploitation despite 621 days since publication.

How an attack unfolds

An attacker supplies a crafted string containing a drive letter to path.join; because drive names are not handled specially, the resulting path resolves to the root of that drive, allowing traversal to sensitive files when the result is used in file operations.

How to fix it

Upgrade nodejs/node to commit e6c7018aa5db77c2cb720c5662eab12ff3320bf4 or later; rebuild and redeploy affected applications after the update.

How to confirm the fix worked

Confirm the installed Node.js binary reports a version containing commit e6c7018aa5db77c2cb720c5662eab12ff3320bf4; test path.join behavior with drive-letter inputs to verify root resolution no longer occurs.

Typical attack path

1. Identify a Node.js application on Windows that passes attacker-controlled input to path.join
2. Craft input containing a drive letter followed by path separators to force root resolution
3. Trigger the vulnerable code path so the joined path is used in fs operations
4. Read or write files outside the intended application directory

How to detect it

Search web server and application logs for path.join results or fs calls containing unexpected drive-letter roots; inspect audit trails for file accesses outside documented application directories.

What your security team should do

• Apply the fixed commit to all Windows Node.js deployments within standard change windows
• Review application code that concatenates paths with user input and replace path.join calls where possible with path.resolve or explicit normalization
• Monitor for any new EPSS increases or exploit publications given the long public disclosure window