Node.js Path Traversal Vulnerability via Drive Name Handling on Windows

A path traversal vulnerability has been identified in Node.js, specifically in the way drive names are managed in the Windows environment. Certain Node.js functions fail to recognize drive names as special cases on Windows. Consequently, while Node.js assumes a path is relative, it actually points to the root directory. This issue arises because, on Windows, a path that does not begin with the file separator is considered relative to the current directory. The vulnerability affects users of the 'path.join' API on Windows.

Impact

This vulnerability could lead to unintended file system access, as paths may be incorrectly resolved to the root directory, potentially allowing for unauthorized file access or manipulation.

Remediation

Users can update to the latest versions of Node.js to address this vulnerability. The patched versions are available in the Node.js v18.20.6, v20.18.2, v22.13.1, and v23.6.1 release lines.