Vulnerability-Lookup

CVE-2025-27210 (GCVE-0-2025-27210)

Vulnerability from cvelistv5 – Published: 2025-07-18 22:54 – Updated: 2025-11-04 21:09

Summary

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-21 17:11 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

hackerone mitre root

References

2 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…
http://www.openwall.com/lists/oss-security/2025/07/22/2

Impacted products

2 products

Vendor	Product	Version	CPE status
nodejs	node	Affected: 20.0.0 , < 20.19.4 (semver) Affected: 22.0.0 , < 22.17.1 (semver) Affected: 24.0.0 , < 24.4.1 (semver)	guessed
nodejs	nodejs	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.* (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.* (semver) Affected: 19.0 , < 19.* (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27210",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-21T17:11:02.439546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-21T18:38:49.855Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:09:47.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/22/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThan": "20.19.4",
              "status": "affected",
              "version": "20.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "22.17.1",
              "status": "affected",
              "version": "22.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "24.4.1",
              "status": "affected",
              "version": "24.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "nodejs",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.*",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.*",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \r\n\r\nThis vulnerability affects Windows users of `path.join` API."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-18T22:54:27.227Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2025-27210",
    "datePublished": "2025-07-18T22:54:27.227Z",
    "dateReserved": "2025-02-20T01:00:01.798Z",
    "dateUpdated": "2025-11-04T21:09:47.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-27210",
      "date": "2026-09-17",
      "epss": "0.14867",
      "percentile": "0.96524"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-27210\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2025-07-18T23:15:23.343\",\"lastModified\":\"2026-06-17T09:03:12.840\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \\r\\n\\r\\nThis vulnerability affects Windows users of `path.join` API.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una soluci\u00f3n incompleta para CVE-2025-23084 en Node.js, que afecta espec\u00edficamente a nombres de dispositivos Windows como CON, PRN y AUX. Esta vulnerabilidad afecta a los usuarios de Windows de la API `path.join`.\"}],\"affected\":[{\"source\":\"support@hackerone.com\",\"affectedData\":[{\"vendor\":\"nodejs\",\"product\":\"node\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"20.0.0\",\"lessThan\":\"20.19.4\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"22.0.0\",\"lessThan\":\"22.17.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"24.0.0\",\"lessThan\":\"24.4.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"nodejs\",\"product\":\"nodejs\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0\",\"lessThan\":\"4.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.0\",\"lessThan\":\"5.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.0\",\"lessThan\":\"6.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.0\",\"lessThan\":\"7.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.0\",\"lessThan\":\"8.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"9.0\",\"lessThan\":\"9.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.0\",\"lessThan\":\"10.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"11.0\",\"lessThan\":\"11.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"12.0\",\"lessThan\":\"12.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"13.0\",\"lessThan\":\"13.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"14.0\",\"lessThan\":\"14.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"15.0\",\"lessThan\":\"15.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"16.0\",\"lessThan\":\"16.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"17.0\",\"lessThan\":\"17.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"18.0\",\"lessThan\":\"18.*\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"19.0\",\"lessThan\":\"19.*\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-07-21T17:11:02.439546Z\",\"id\":\"CVE-2025-27210\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://nodejs.org/en/blog/vulnerability/july-2025-security-releases\",\"source\":\"support@hackerone.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/07/22/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-07-20T23:08:13+00:00",
      "cve": "CVE-2025-27210",
      "id": "CVE-2025-27210",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2025-27210",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-27210.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/07/22/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T21:09:47.526Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-27210\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-21T17:11:02.439546Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-21T17:12:58.565Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\"}}], \"affected\": [{\"vendor\": \"nodejs\", \"product\": \"node\", \"versions\": [{\"status\": \"affected\", \"version\": \"20.0.0\", \"lessThan\": \"20.19.4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.0.0\", \"lessThan\": \"22.17.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"24.0.0\", \"lessThan\": \"24.4.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"nodejs\", \"product\": \"nodejs\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0\", \"lessThan\": \"4.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.0\", \"lessThan\": \"5.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0\", \"lessThan\": \"6.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"7.0\", \"lessThan\": \"7.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.0\", \"lessThan\": \"8.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"9.0\", \"lessThan\": \"9.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.0\", \"lessThan\": \"10.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.0\", \"lessThan\": \"11.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"13.0\", \"lessThan\": \"13.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"14.0\", \"lessThan\": \"14.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"15.0\", \"lessThan\": \"15.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"16.0\", \"lessThan\": \"16.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"17.0\", \"lessThan\": \"17.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"18.0\", \"lessThan\": \"18.*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"19.0\", \"lessThan\": \"19.*\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://nodejs.org/en/blog/vulnerability/july-2025-security-releases\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \\r\\n\\r\\nThis vulnerability affects Windows users of `path.join` API.\"}], \"providerMetadata\": {\"orgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"shortName\": \"hackerone\", \"dateUpdated\": \"2025-07-18T22:54:27.227Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-27210\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T21:09:47.526Z\", \"dateReserved\": \"2025-02-20T01:00:01.798Z\", \"assignerOrgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"datePublished\": \"2025-07-18T22:54:27.227Z\", \"assignerShortName\": \"hackerone\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-27210

Vulnerability from fkie_nvd - Published: 2025-07-18 23:15 - Updated: 2026-06-17 09:03

Severity

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

References

	URL	Tags
	support@hackerone.com	https://nodejs.org/en/blog/vulnerability/july-2025-security-releases
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2025/07/22/2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThan": "20.19.4",
              "status": "affected",
              "version": "20.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "22.17.1",
              "status": "affected",
              "version": "22.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "24.4.1",
              "status": "affected",
              "version": "24.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "nodejs",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.*",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.*",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \r\n\r\nThis vulnerability affects Windows users of `path.join` API."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una soluci\u00f3n incompleta para CVE-2025-23084 en Node.js, que afecta espec\u00edficamente a nombres de dispositivos Windows como CON, PRN y AUX. Esta vulnerabilidad afecta a los usuarios de Windows de la API `path.join`."
    }
  ],
  "id": "CVE-2025-27210",
  "lastModified": "2026-06-17T09:03:12.840",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "support@hackerone.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27210",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-07-21T17:11:02.439546Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-07-18T23:15:23.343",
  "references": [
    {
      "source": "support@hackerone.com",
      "url": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2025/07/22/2"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-X33R-PVVQ-WJRH

Vulnerability from github – Published: 2025-07-19 00:32 – Updated: 2025-11-05 00:31

Details

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.

This vulnerability affects Windows users of path.join API.

Severity

7.5 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-27210"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-18T23:15:23Z",
    "severity": "HIGH"
  },
  "details": "An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \n\nThis vulnerability affects Windows users of `path.join` API.",
  "id": "GHSA-x33r-pvvq-wjrh",
  "modified": "2025-11-05T00:31:22Z",
  "published": "2025-07-19T00:32:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27210"
    },
    {
      "type": "WEB",
      "url": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/07/22/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2025-27210

Vulnerability from csaf_microsoft - Published: 2026-08-07 01:00 - Updated: 2026-08-07 01:00

Summary

CVE-2025-27210

Scope

1 vulnerability in this advisory, including CVE-2025-27210.

CVE-2025-27210

Fixed: 1 product Known affected: 1 product

Open the full advisory

NCSC-2025-0330

Vulnerability from csaf_ncscnl - Published: 2025-10-23 13:20 - Updated: 2025-10-23 13:20

Summary

Kwetsbaarheden verholpen in Oracle Communications producten

Scope

50 vulnerabilities in this advisory, including CVE-2025-27210.

CVE-2025-27210

Node.js versions 20.x, 22.x, and 24.x have an incomplete fix for CVE-2025-23084 affecting Windows device names and the `path.join` API, while Oracle Communications' Cloud Native Environment has a non-exploitable Security-in-Depth issue.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Known affected: 36 products

Open the full advisory

NCSC-2026-0023

Vulnerability from csaf_ncscnl - Published: 2026-01-21 09:27 - Updated: 2026-01-21 09:27

Summary

Kwetsbaarheden verholpen in Oracle PeopleSoft

Scope

12 vulnerabilities in this advisory, including CVE-2025-27210.

CVE-2025-27210

Recent vulnerabilities in Oracle JD Edwards and Node.js expose critical data and sensitive information, with CVSS scores indicating significant risk, particularly for Windows users and specific device names.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Known affected: 4 products

Open the full advisory

NCSC-2026-0031

Vulnerability from csaf_ncscnl - Published: 2026-01-21 10:12 - Updated: 2026-01-21 10:12

Summary

Kwetsbaarheden verholpen in Oracle JD Edwards

Scope

7 vulnerabilities in this advisory, including CVE-2025-27210.

CVE-2025-27210

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Known affected: 1 product

Open the full advisory

WID-SEC-W-2025-1578

Vulnerability from csaf_certbund - Published: 2025-07-15 22:00 - Updated: 2026-02-18 23:00

Summary

Node.js: Mehrere Schwachstellen

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2025-27210.

CVE-2025-27210

Known affected: 11 products

Open the full advisory

WID-SEC-W-2025-2360

Vulnerability from csaf_certbund - Published: 2025-10-21 22:00 - Updated: 2025-11-17 23:00

Summary

Oracle Communications Applications: Mehrere Schwachstellen

Severity

Hoch

Scope

34 vulnerabilities in this advisory, including CVE-2025-27210.

CVE-2025-27210

Known affected: 24 products Last affected: 7 products

Open the full advisory

WID-SEC-W-2026-0167

Vulnerability from csaf_certbund - Published: 2026-01-20 23:00 - Updated: 2026-01-20 23:00

Summary

Oracle PeopleSoft: Mehrere Schwachstellen

Severity

Hoch

Scope

12 vulnerabilities in this advisory, including CVE-2025-27210.

CVE-2025-27210

Known affected: 4 products

Open the full advisory

WID-SEC-W-2026-0169

Vulnerability from csaf_certbund - Published: 2026-01-20 23:00 - Updated: 2026-01-20 23:00

Summary

Oracle JD Edwards: Mehrere Schwachstellen

Severity

Hoch

Scope

7 vulnerabilities in this advisory, including CVE-2025-27210.

CVE-2025-27210

Last affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-27210 (GCVE-0-2025-27210)

Tags

Sightings

Nomenclature

Related by attack behaviour