Node.js Path Traversal on Windows: CVE-2025-27210 Exploited with Device Names (PoC Inside)

A single overlooked edge case can open the door to arbitrary file access on Windows-based Node.js applications. CVE-2025-27210 shows how a platform-specific quirk, Windows' reserved device names, can get past a security patch that was meant to close the hole. A working proof-of-concept exploit is already public, so defenders need to move.

Introduction

Node.js runs countless web services, APIs, and enterprise applications. It is maintained by the OpenJS Foundation and deployed across many industries. Its cross-platform reach and large ecosystem make it a target for attackers and a priority for defenders. In July 2025, a high-severity path traversal vulnerability, CVE-2025-27210, was disclosed. It affects all major supported Node.js branches on Windows. The flaw lets attackers bypass directory protections by abusing legacy device names like CON, PRN, and AUX, which exposes sensitive files to unauthorized access.

Technical Information

CVE-2025-27210 comes from how Node.js handles file paths on Windows. Windows reserves certain device names, such as CON, PRN, AUX, NUL, COM1-COM9, and LPT1-LPT9, and the operating system treats them as special files rather than regular filenames. Node.js's path.join and path.normalize APIs are widely used to sanitize and resolve file paths, especially for file uploads, downloads, and static file serving.

A previous vulnerability, CVE-2025-23084, tried to address path traversal through these APIs, but the fix was incomplete. It did not account for Windows device names embedded in user-supplied paths. An attacker could craft a path such as ..\CON or AUX\..\..\etc\passwd and submit it to a vulnerable Node.js application. When path.join or path.normalize processed these paths, they could bypass the intended directory restrictions and grant access to arbitrary files on the system.

The vulnerability is specific to Windows because of how it handles device names. Any Node.js application that uses these path APIs with user-controlled input is at risk if it does not validate that input strictly. The impact can be severe: unauthorized file reads, exposure of sensitive configuration files, or further exploitation if privileged files are reached.

Proof of Concept

Understanding how a vulnerability works matters for both defense and offense. A recent proof-of-concept (PoC) exploit for CVE-2025-27210 shows a path traversal vulnerability specific to Node.js applications running on Microsoft Windows.

Understanding the Vulnerability:

Path traversal vulnerabilities occur when an application fails to sanitize user-supplied input, which lets attackers reach files and directories outside the intended scope. Here, the vulnerability exploits how Windows handles reserved device file names, such as AUX, CON, and NUL, together with directory traversal sequences (../). When Node.js functions like path.join() or path.normalize() process these sequences, they can lead to unauthorized file access.

The Proof-of-Concept Exploit:

The PoC shows how an attacker can use this vulnerability to reach sensitive files on the system. By crafting a malicious request with specific traversal sequences and reserved device names, the attacker can bypass normal access controls. For example, a command like:

python CVE-2025-27210_NodeJS_Path_Traversal_Exploiter.py -t http://localhost:3000/download -f C:\Windows\System32\drivers\etc\hosts

This command targets a vulnerable Node.js application running locally and tries to retrieve the system's hosts file, which can contain network configuration information.

Implications:

Exploiting this vulnerability can give an attacker unauthorized access to sensitive files, exposing confidential data or system configurations. That access can become a foothold for further exploitation, including privilege escalation or lateral movement within a network.

Conclusion:

This PoC shows why rigorous input validation and careful file path handling matter. Developers need to sanitize user input and account for platform-specific quirks, such as how Windows handles reserved device names, to prevent these vulnerabilities.

PoC Source: Sploitus

Patch Information

The Node.js team released updates across the 24.x, 22.x, and 20.x release lines. These updates address the following issues:

1. Windows Device Names Bypass in path.normalize() (CVE-2025-27210):

The previous fix for CVE-2025-23084 was incomplete and let certain Windows device names (such as CON, PRN, AUX) bypass path traversal protections. The latest patch updates the path.join API to handle these device names correctly, so they cannot be used to traverse directories.

2. HashDoS in V8 (CVE-2025-27209):

The V8 engine's string hashing was changed to use rapidhash, which reintroduced a HashDoS vulnerability. The patch reverts that change and restores the previous hashing method, which prevents attackers from generating hash collisions.

Updated Versions:

• Node.js v20.19.4
• Node.js v22.17.1
• Node.js v24.4.1

Upgrade to these versions to fix the vulnerabilities. Details and download links are in the official security release announcement.

Patch Source: Node.js Security Release

Affected Systems and Versions

CVE-2025-27210 affects the following Node.js versions on Windows:

• Node.js 20.x prior to 20.19.4
• Node.js 22.x prior to 22.17.1
• Node.js 24.x prior to 24.4.1

Any Node.js application on Windows that uses path.join or path.normalize with user-supplied input is vulnerable. Linux and macOS are not affected by this issue.

Vendor Security History

Node.js has had path traversal and input validation vulnerabilities before, particularly around file path resolution and dependency management. The vendor's response to CVE-2025-27210 was fast: patches shipped for all supported branches within days of disclosure. The earlier incomplete fix, CVE-2025-23084, shows how hard it is to secure cross-platform APIs when legacy platform behaviors like Windows device names are involved. The OpenJS Foundation runs a mature security disclosure process and has been transparent and responsive on critical issues.

References

• Node.js Security Release (July 2025)
• Sploitus PoC for CVE-2025-27210
• NVD Entry for CVE-2025-27210
• Herodevs Vulnerability Directory: CVE-2025-27210

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]