CVE-2024-37372 — nodejs: Permission model improperly processes UNC paths

Back Back to CVE browser

LOW

nodejs: Permission model improperly processes UNC paths

Published Jan 9, 2025

3.6

LOW

CVSS 3.1

EPSS 0.49%

Description

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

Affected products

Vendor Node.js Product Node Default
unaffected
- Version
  10.0
  Status
  affected
  Constraints
  <10.*
- Version
  11.0
  Status
  affected
  Constraints
  <11.*
- Version
  12.0
  Status
  affected
  Constraints
  <12.*
- Version
  13.0
  Status
  affected
  Constraints
  <13.*
- Version
  14.0
  Status
  affected
  Constraints
  <14.*
- Version
  15.0
  Status
  affected
  Constraints
  <15.*
- Version
  16.0
  Status
  affected
  Constraints
  <16.*
- Version
  17.0
  Status
  affected
  Constraints
  <17.*
- Version
  19.0
  Status
  affected
  Constraints
  <19.*
- Version
  20.0
  Status
  affected
  Constraints
  <20.15.1
- Version
  21.0
  Status
  affected
  Constraints
  <21.*
- Version
  22.0
  Status
  affected
  Constraints
  <22.4.1
- Version
  4.0
  Status
  affected
  Constraints
  <4.*
- Version
  5.0
  Status
  affected
  Constraints
  <5.*
- Version
  6.0
  Status
  affected
  Constraints
  <6.*
- Version
  7.0
  Status
  affected
  Constraints
  <7.*
- Version
  8.0
  Status
  affected
  Constraints
  <8.*
- Version
  9.0
  Status
  affected
  Constraints
  <9.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Node.js

Node

unaffected

Version	Status	Constraints
10.0	affected	<10.*
11.0	affected	<11.*
12.0	affected	<12.*
13.0	affected	<13.*
14.0	affected	<14.*
15.0	affected	<15.*
16.0	affected	<16.*
17.0	affected	<17.*
19.0	affected	<19.*
20.0	affected	<20.15.1
21.0	affected	<21.*
22.0	affected	<22.4.1
4.0	affected	<4.*
5.0	affected	<5.*
6.0	affected	<6.*
7.0	affected	<7.*
8.0	affected	<8.*
9.0	affected	<9.*

Red Hat Enterprise Linux 10

nodejs22

Not affected
Red Hat Enterprise Linux 8

nodejs:18/nodejs

Not affected
Red Hat Enterprise Linux 8

nodejs:20/nodejs

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	nodejs22	Not affected	n/a
Red Hat Enterprise Linux 8	nodejs:18/nodejs	Not affected	n/a
Red Hat Enterprise Linux 8	nodejs:20/nodejs	Not affected	n/a

Remediation

Red Hat statement

This vulnerability affects Windows users of the Node.js Permission Model in version v22.x and v20.x. No Red Hat products are affected.

Metrics

0.49% 0.00487

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00487

Score over time

2025–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (4 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.49% (0.00487)	39.62th	v5 (v2026.06.15)
Jun 15, 2026	0.43% (0.00431)	34.18th	v5 (v2026.06.15)
Mar 17, 2025	0.02% (0.00019)	2.84th	v4 (v2025.03.14)
Jan 9, 2025	0.04% (0.00043)	11.09th	v3 (v2023.03.01)

Weaknesses (2)

CWE-22

Path Traversal

CWE-754

References (7)

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2024/07/11/6
http://www.openwall.com/lists/oss-security/2024/07/19/3
https://access.redhat.com/security/cve/CVE-2024-37372		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2336663		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2024-37372
https://security.netapp.com/advisory/ntap-20250502-0010/
https://www.cve.org/CVERecord?id=CVE-2024-37372