https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:46:56.880494+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-10621 bdu:2025-10621 2026-10-03T17:46:57.037509+00:00 bdu:2025-10621 https://cve.radiocsirt.org/vuln/bit-node-2025-23084 BIT-node-2025-23084 2026-10-03T17:46:57.037549+00:00

Affected: Bitnami: node

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0060 certfr-2025-avi-0060 — De multiples vulnérabilités ont été découvertes dans Node.js. Elles permettent à un attaquant de provoquer un déni de s… 2026-10-03T17:46:57.037583+00:00 certfr-2025-avi-0060 https://cve.radiocsirt.org/vuln/euvd-2026-259934 EUVD-2026-259934 2026-10-03T17:46:57.037600+00:00 EUVD-2026-259934 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23084 fkie_cve-2025-23084 2026-10-03T17:46:57.037611+00:00

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

 https://cve.radiocsirt.org/vuln/ghsa-37v4-cwgp-x353 GHSA-37v4-cwgp-x353 2026-10-03T17:46:57.037634+00:00

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

On Windows, a path that does not start with the file separator is treated as relative to the current directory.

This vulnerability affects Windows users of `path.join` API.

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-23084 msrc_CVE-2025-23084 — A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows envir… 2026-10-03T17:46:57.037652+00:00 msrc_CVE-2025-23084 https://cve.radiocsirt.org/vuln/oesa-2025-1090 OESA-2025-1090 — nodejs security update 2026-10-03T17:46:57.037670+00:00

Affected: openEuler:24.03-LTS: nodejs

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

On Windows, a path that does not start with the file separator is treated as relative to the current directory.

This vulnerability affects Windows users of `path.join` API.(CVE-2025-23084)

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.(CVE-2025-23085)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23084 Withdrawn: UBUNTU-CVE-2025-23084 2026-10-03T17:46:57.037701+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:20.04:LTS: nodejs, Ubuntu:22.04:LTS: nodejs, Ubuntu:24.10: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:25.04: nodejs

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0156 WID-SEC-W-2025-0156 — Node.js: Mehrere Schwachstellen 2026-10-03T17:46:57.037732+00:00

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, einen Denial-of-Service-Zustand herbeizuführen oder nicht näher spezifizierte Angriffe zu starten.