CVE-2025-27210
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.
- Update to 24.4.1
Published Updated
PatchFirst · Latest vulnerabilities
node.js 24.0.0: known vulnerabilities
Known vulnerabilities affecting node.js 24.0.0: 3. Compare the fixes below with your installed release.
Vulnerabilities: 3
CVE-2025-27209
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed. * This vulnerability affects Node.js v24.x users.
- Update to 24.4.1
Published UpdatedCVE-2025-23166
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.