Node.js Windows Device Names Path Traversal Vulnerability

A vulnerability has been identified in Node.js that affects the `path.join` API on Windows systems. This issue arises from an incomplete fix for a previous vulnerability (CVE-2025-23084) and specifically impacts Windows device names such as CON, PRN, and AUX. The vulnerability allows these device names to bypass path traversal protections, potentially leading to unintended file access or manipulation.

Impact

Exploitation of this vulnerability could allow for path traversal attacks, where an attacker could manipulate file paths to access or modify files outside of the intended directory structure.

Remediation

Users can update to the latest versions of Node.js in the 20.x, 22.x, and 24.x release lines to address this vulnerability.