Node.js Vulnerability Impacting Windows Drive Name Handling

CVE-2025-23084

What is CVE-2025-23084?

A security flaw has been discovered in Node.js that affects the handling of drive names on Windows systems. This issue arises when certain Node.js functions misinterpret drive names as regular paths instead of special identifiers. Consequently, even when a relative path is expected, Node.js may incorrectly reference the root directory instead of the intended location. This vulnerability specifically targets the path.join API, impacting Windows users who rely on accurate directory referencing.

References