●Change8

Migrating to Node.js v20.19.4

Version v20.19.4 introduces 1 breaking change. This guide details how to update your code.

Released: 7/15/2025

1
Breaking Changes
1
Migration Steps
2
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

path.normalizelib/path.js

Breaking Changes

●Issue #1

The path.normalize() function on Windows now correctly handles reserved device names (CON, PRN, AUX, etc.), which may change the output for paths previously exploiting these names to bypass traversal protections.

Migration Steps

  1. 1
    Update Node.js to the latest security release to ensure path.normalize() correctly handles Windows reserved device names.

Release Summary

This security release addresses CVE-2025-27210, fixing a path traversal protection bypass in path.normalize() related to Windows reserved device names.

Need More Details?

View the full release notes and all changes for Node.js v20.19.4.

View Full Changelog