Path Validation Vulnerability (Updated 29-September-2017 - CVE assigned)

The Node.js project released a new version of 8.x this week which incorporates a security fix.

Impact

Version 8.5.0 of Node.js is vulnerable. 4.x and 6.x versions are NOT vulnerable.

Downloads

Node.js 8 (Current)

Node.js-specific security flaws

Node.js version 8.5.0 included a change which caused a security vulnerability in the checks on paths made by some community modules. As a result, an attacker may be able to access file system paths other than those intended.

This problem was resolved within Node.js by partially reverting <https://github.com/nodejs/node/commit/b98e8d995efb426bbdee56ce503017bdcbbc6332&gt;.

A CVE has been assigned as CVE-2017-14849