CVE-2025-27210

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
nodejs	node	>= 20.0.0, < 20.19.4; >= 22.0.0, < 22.17.1; >= 24.0.0, < 24.4.1
nodejs	nodejs	>= 4.0, < 4.; >= 5.0, < 5.; >= 6.0, < 6.; >= 7.0, < 7.; >= 8.0, < 8.; >= 9.0, < 9.; >= 10.0, < 10.; >= 11.0, < 11.; >= 12.0, < 12.; >= 13.0, < 13.; >= 14.0, < 14.; >= 15.0, < 15.; >= 16.0, < 16.; >= 17.0, < 17.; >= 18.0, < 18.; >= 19.0, < 19.

References

Timeline

Published: Jul 18, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-272117.5An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with ac CVE-2025-272129.8An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Acces CVE-2025-272134.9An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug B CVE-2025-272149.8A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical o CVE-2025-272158.1An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsu CVE-2025-272168.8Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to e CVE-2025-272179.1A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside o CVE-2025-272185.3Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserializa CVE-2025-272197.5In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerabi CVE-2025-272207.5In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.CVE-2025-272215.3In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication cr CVE-2025-272228.6TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn