Starstruk Logo MarkStarstruk

v22.17.1

nodejs/nodev22.17.1Jul 15, 2025by RafaelGSS

AI Summary

A security release addressing Windows path traversal vulnerabilities.

Key Highlights

  • CVE-2025-27210: Bypass of path traversal protection for Windows reserved device names
  • Fixed MSVS v17.14 compilation issues

Full Release Notes




This is a security release.

### Notable Changes

* (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

### Commits

* \[[`8cf5d66ab7`](https://github.com/nodejs/node/commit/8cf5d66ab7)] - **(CVE-2025-27210)** **lib**: handle all windows reserved driver name (RafaelGSS) [nodejs-private/node-private#721](https://github.com/nodejs-private/node-private/pull/721)
* \[[`9c0cb487ec`](https://github.com/nodejs/node/commit/9c0cb487ec)] - **win,build**: fix MSVS v17.14 compilation issue (StefanStojanovic) [#58902](https://github.com/nodejs/node/pull/58902)