CVE-2017-14849: Node.js path traversal via incompatible '..' handling in community modules

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated file disclosure with high confidentiality impact and a very high EPSS score, though no known exploitation in KEV.

What it is

Node.js 8.5.0 before 8.6.0 changed how '..' is handled, which broke the pathname validation used by unspecified community modules. This lets remote attackers reach files outside the intended directory. The flaw matters because it is remotely reachable without authentication and exposes file contents.

Impact

An attacker can read unintended files that the Node.js process can access. There is no integrity or availability impact; the loss is confidentiality.

Attack surface

Reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The vulnerable path is exercised through community modules that rely on the affected pathname validation.

Exploitation

Not listed in CISA KEV and no ransomware use is documented. EPSS is high at 0.54389 (99th percentile), and references are patch and advisory entries, not exploit code.

What to do

• Upgrade Node.js to 8.6.0 or later; the vendor advisory is the patch reference.
• Audit community modules that perform their own pathname validation and update or replace those that depend on the old '..' behavior.
• Normalize and validate file paths against an allowlisted base directory before any file read.
• Run the Node.js process with least privilege so a traversal read cannot reach sensitive files.

Detection

• Monitor file access logs for reads of paths containing '..' or paths outside the application's expected directories.
• Alert on Node.js processes reading sensitive files such as /etc/passwd or application configuration outside their working tree.
• Review HTTP request logs for encoded traversal sequences (for example %2e%2e) reaching file-serving endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.