- Fixed CVE‑2025‑27210: prevented Windows reserved device names (CON, PRN, AUX) from bypassing path.normalize() protection.
- Updated lib to correctly handle all Windows reserved driver names.
Open Source changelog digest
Jul 14 - Jul 20, 2025. Useful releases, risky migrations, and noisy updates from the Open Source channel.
No matching updates in this bucket.
Open Source updates in 2025-w29
- - Fixed CVE‑2025‑27210 by handling Windows reserved device names (CON, PRN, AUX) and tightening path.normalize() traversal protection.
- - Updated lib to block reserved driver names on Windows.
- - Patched MSVS v17.14 compilation issue on Windows builds.
- Patched CVE-2025-27209: mitigated HashDoS in V8 by reverting recent rapidhash changes.
- Patched CVE-2025-27210: fixed Windows reserved device names (CON, PRN, AUX) bypass in path.normalize().
- Updated V8 dependency and added handling for all Windows reserved driver names.