{
  "cve": [
    "CVE-2025-23084"
  ],
  "vulnerable": "18.x || 20.x || 22.x || 23.x",
  "patched": "^18.20.6 || ^20.18.2 || ^22.13.1 || ^23.6.1",
  "ref": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases/",
  "description": "Path traversal by drive name in Windows environment",
  "overview": "A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.\n\nOn Windows, a path that does not start with the file separator is treated as relative to the current directory. \n\nThis vulnerability affects Windows users of `path.join` API.\n\n\n\n\n\n",
  "affectedEnvironments": [
    "win32"
  ],
  "severity": "medium"
}