Test ID:	1.3.6.1.4.1.25623.1.0.153856
Category:	General
Title:	Node.js < 18.20.6, 20.x < 20.18.2, 21.x < 22.13.1, 23.x < 23.6.1 Multiple Vulnerabilities - Windows
Summary:	Node.js is prone to multiple vulnerabilities.
Description:	Summary: Node.js is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2025-23084: Path traversal by drive name in Windows environment - CVE-2025-23085: GOAWAY HTTP/2 frames cause memory leak outside heap - CVE-2025-23087, CVE-2025-23088, CVE-2025-23089: Various fixes in EOL versions Note: CVE-2025-23087, CVE-2025-23088 and CVE-2025-23089 have been marked as 'Rejected' in the CVE list but still used / referenced by the vendor. They have been kept in this VT on purpose. Please see the vendor statement on these linked in the references. Affected Software/OS: Node.js version 23.x and prior. Solution: Update to version 18.20.6, 20.18.2, 22.13.1, 23.6.1 or later. CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2025-23084 Common Vulnerability Exposure (CVE) ID: CVE-2025-23085 Common Vulnerability Exposure (CVE) ID: CVE-2025-23087 Common Vulnerability Exposure (CVE) ID: CVE-2025-23088 Common Vulnerability Exposure (CVE) ID: CVE-2025-23089
Copyright	Copyright (C) 2025 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.