CVE-2025-27210
High · 7.5CVSS
7.5
EPSS
14.3%
Published
Jul 18, 2025
CISA due date
—
The record
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | node | 4.0.0 | 20.19.4 |
| Bitnami | node-min | 4.0.0 | 20.19.4 |
Related vulnerabilities
- CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js… Also affects node
- CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size… Also affects node
- CVE-2025-55132 A flaw in Node.js's permission model allows a file's access and modification timestamps… Also affects node
- CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate… Also affects node
- CVE-2025-55131 A flaw in Node.js's buffer allocation logic can expose uninitialized memory when… Also affects node
- CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and… Also affects node
- HSEC-2024-0003 process: command injection via argument list on Windows Also affects node
- CVE-2025-23085 A memory leak could occur when a remote peer abruptly closes the socket without sending a… Also affects node