CVE-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

14.87% chance of exploitation in the next 30 days, 96th percentile

Published

2025-07-18

Updated

2025-11-04

Proof-of-concept exploits (2)

• absholi7ly/CVE-2025-27210_NodeJS_Path_Traversal_Exploit2★ · 2025-07-16
• mindeddu/Vulnerable-CVE-2025-272100★ · 2025-09-17

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52369

References

• CVE Record
• NVD entry

Related

• CVE-2023-20048
• CVE-2023-50029
• CVE-2024-21683
• CVE-2024-30056
• CVE-2024-32113
• CVE-2024-32459