The Node.js project has recently announced critical security releases across multiple versions, including v24.4.1 (Current), v20.19.4 (LTS), and v22.17.1 (LTS). These releases address two high-severity vulnerabilities, CVE-2025-27209 and CVE-2025-27210, threatening Node.js users on Windows and those utilizing hash-based services.
CVE-2025-27209: V8 Engine Hash Collision 
The CVE-2025-27209 is a Hash Collision Denial-of-Service vulnerability found in the V8 JavaScript engine’s rapidhash algorithm. This vulnerability affects all Node.js 24.x users, allowing potential attackers to exploit hash collisions to exhaust server resources, leading to service outages. The issue has been mitigated by reverting specific commits in the V8 engine concerning the rapidhash implementation.
CVE-2025-27210: Path Traversal on Windows 
CVE-2025-27210 exposes Node.js applications running on Windows to potential path traversal attacks. This flaw allows attackers to bypass path protection mechanisms using reserved device names like CON, PRN, and AUX in the path.normalize() and path.join() functions. Windows users on Node.js versions 20.x, 22.x, and 24.x are particularly vulnerable. The security fix ensures proper handling of Windows reserved device names to prevent unauthorized file access.
Security Patches and Updates 
The vulnerabilities were addressed with security releases issued on July 15, 2025. For Node.js v24.4.1, fixes include reverting V8 engine commits and updating path handling mechanisms. Version v20.19.4 (LTS) and v22.17.1 (LTS) also received updates to correct the path traversal issue, with v22.17.1 additionally resolving MSVS v17.14 compilation issues on Windows platforms.
The Node.js team encourages all users to update to the latest versions to protect against these vulnerabilities. The releases are available for download across supported platforms, including Windows, macOS, Linux, and various architectures.

Collections

Node.js released critical security updates for versions 24.4.1, 20.19.4, and 22.17.1 to address two high-severity vulnerabilities. CVE-2025-27209 affects the V8 engine's hash algorithm, enabling denial-of-service attacks through hash collisions. CVE-2025-27210 allows path traversal attacks on Windows systems by exploiting reserved device names in path functions. All users are urged to update immediately to protect against these security threats.

Node.js Security Releases: Addressing Critical Vulnerabilities in Current and LTS Versions