Node.js patches path traversal and HashDoS bugs

CVE-2025-27210 breaks Windows path.normalize() with device names; CVE-2025-27209 reintroduces HashDoS in V8's rapidhash—upgrade 20.x, 22.x, 24.x before July 15.

July 7, 2026

Summary

Windows developers using path.join are exposed to directory traversal attacks; all 24.x users face collision-based DoS on attacker-controlled string hashing. Mandatory upgrades block production deployments.

Why it matters

Implementation verdict

Patch version bumps (20.19.4, 22.17.1, 24.4.1) replace vulnerable builds. No code changes required—upgrade immediately after July 15 release. Both are high-severity, blocking use of affected release lines in security-conscious environments.

Sources

1.Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() (CVE-2025-27210) - (high)
2.This vulnerability affects Windows users of path.join API
3.an attacker who can control the strings to be hashed can generate many hash collisions
4.The 24.x release line of Node.js is vulnerable to 2 high severity issues

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs