The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not alw

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• NodeJS Node

  • 4.0 and later · before 4.*affected · semver
  • 5.0 and later · before 5.*affected · semver
  • 6.0 and later · before 6.*affected · semver
  • 7.0 and later · before 7.*affected · semver
  • 8.0 and later · before 8.*affected · semver
  • 9.0 and later · before 9.*affected · semver
  • 10.0 and later · before 10.*affected · semver
  • 11.0 and later · before 11.*affected · semver
  • 12.0 and later · before 12.*affected · semver
  • 13.0 and later · before 13.*affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2024-27983An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 f
  58Plan
• CVE-2025-27210An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.
  35Monitor
• CVE-2024-27980Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject a
  32Monitor
• CVE-2024-36138Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child
  32Monitor
• CVE-2026-56848A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is execut
  30Monitor
• CVE-2026-56846A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.