Node.js Drive Name Handling Vulnerability in Alpine Package
Summary
ALPINE-CVE-2025-23084: A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Affects nodejs versions < 22.13.1-r0. Fixed in 22.13.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The Alpine package for Node.js provides a lightweight and efficient version of Node.js tailored for Alpine Linux. However, a vulnerability has been identified in the way Node.js handles drive names specifically in the Windows environment, which can lead to unintended access to the root directory.
Vulnerability Detail
A vulnerability has been identified in Node.js that affects the handling of drive names in the Windows environment. Certain functions in Node.js do not treat drive names as special, leading to a situation where a relative path is incorrectly interpreted as referring to the root directory. This can result in security risks, as it may allow unauthorized access to sensitive files or directories. The vulnerability specifically impacts users utilizing the path.join API on Windows systems.
How To Fix
Minimum fixed version
22.13.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the path.join API with drive names until the package is updated. Instead, consider using absolute paths or validating paths before processing them to ensure they do not inadvertently reference the root directory.
Conclusion
In summary, a vulnerability in Node.js affects the handling of drive names on Windows, posing a risk of unauthorized access to the root directory. Users are advised to update to the patched version of the package to mitigate this risk. Temporary workarounds are available, but updating is the best course of action.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of severity.
Windows users of Node.js who utilize the path.join API are primarily affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider using alternative methods for path handling or validating paths to mitigate the risk.
More information can be found in the CVE details at https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2025-23084.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
