CVE-2026-49030

View on CVE.org
Published Sep 13, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References

No reference.

History
Type Values Removed Values Added
References
Type Values Removed Values Added
Description pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join(), resolve(), and normalize() to interpret backslash-separated dot notation sequences as directory traversal, diverging from Node.js path.posix behavior and enabling path traversal attacks that bypass common input validation in server-side applications. NOTE: the Supplier reports that "the behavior is documented, intentional, and identical in spirit to path.win32." DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Type Values Removed Values Added
Description pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join(), resolve(), and normalize() to interpret backslash-separated dot notation sequences as directory traversal, diverging from Node.js path.posix behavior and enabling path traversal attacks that bypass common input validation in server-side applications. NOTE: the Supplier reports that "the behavior is documented, intentional, and identical in spirit to path.win32."
References

Subscriptions

No data.

Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
mitre
Published
Updated
Sep 13, 2026, 9:09 PM
Reserved
Jun 4, 2026, 12:00 AM

View source JSON

No data.

Status
Rejected
Published
Sep 13, 2026, 9:17 PM
Modified
Sep 13, 2026, 10:16 PM

View source JSON

No data.

No data.