Overview
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers an event-driven, non-blocking I/O model and is widely used in server-side applications.
An Path Traversal vulnerability has been identified in Node.js on Windows. The issue stems from improper handling of drive names in the Windows environment. This weakness allows attackers to access unintended directories.
This vulnerability affects specific versions of the package and can result in unauthorized access. Details on affected versions and reproduction steps are provided below.
Details
Module Info
Affected packages: Node.js
Affected versions: 4.0 < 18.20.6, 20 < 20.18.2
GitHub repository: https://github.com/nodejs/node
Published packages: https://github.com/nodejs/node/releases
Package manager: npm
Fixed in: Node.js NES version v12, v14, v16
Vulnerability Info
The issue was introduced in version 4.0 and stems from improper handling of drive names in the Windows environment.
For instance, in Windows, if a path does not start with the file separator, the system treats it as relative to the current directory. This behavior can be exploited by attackers to access unintended directories.
This vulnerability is a result of flawed logic, and may allow attackers to access unintended directories.
- https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
- https://owasp.org/www-community/attacks/Path_Traversal
Credits
- ryotak
Mitigation
This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.
- Update to a patched LTS version of Node.js
- Leverage a commercial support partner like HeroDevs for post-EOL security.
Refer to the Nes Documentation for upgrade instructions.
