CVE-2025-27210

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-18 · updated 2026-06-17
Weakness: CWE-22

Description

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

Affected products

Node.js: from 20.0.0 before 20.19.4; from 22.0.0 before 22.17.1; from 24.0.0 before 24.4.1 — fixed in 20.19.4, 22.17.1, 24.4.1
nodejs: 4.x from 4.0; 5.x from 5.0; 6.x from 6.0; 7.x from 7.0; 8.x from 8.0; 9.x from 9.0

How to fix

Upgrade to a fixed version: Node.js 20.19.4, 22.17.1, 24.4.1. Check the vendor advisory for mitigations.

References

https://nodejs.org/en/blog/vulnerability/july-2025-security-releases
http://www.openwall.com/lists/oss-security/2025/07/22/2

Get alerted when CVE-2025-27210 or the next vulnerability affects your stack