August 3, 2026

CVE Watchtower


← Back to CVE List

CVE-2025-27210NVD

Vulnerability Summary

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.

This vulnerability affects Windows users of `path.join` API.
Severity Level
HIGH(7.5)
Published Date
Jul 18, 2025
Last Modified
Jul 22, 2025
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
CWE-22: Path Traversal ↗
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.
CVSS v3.0 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

External References