CVE intelligence

CVE-2025-27210

Vulnerability intelligence

Published Jul 18, 2025Sources checked Nov 11, 2026

7.5HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2025-27210 and is rated High severity with a CVSS score of 7.5. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

Public exploit: Cataloged public exploit.

Exploit-DB: NodeJS 24.x - Path Traversal (2026-09-23 21:40:27.335989+00)
Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

CISA KEVNot listedBased on the latest collected catalog

EPSS14.3%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-27210?

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.

This vulnerability affects Windows users of `path.join` API.

Source: NVD