CVE-2017-14849
HighNode.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Published Sep 28, 2017 · Updated Jul 8, 2026
Key Facts
Patch immediately- CVE-2017-14849 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Node.js (Nodejs), nodejs (debian), firefox-atk (suse) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 54% probability of exploitation in the next 30 days.
- Fixed versions are available, including firefox-atk 2.26.1-2.8.4, firefox-atk-lang 2.26.1-2.8.4, firefox-cairo 1.15.10-2.13.4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
54%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2017-14849 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Affected Products
68 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Node.jsNodejs | 8.5.0 | n/a |
| nodejsdebian | See advisory | 0 |
| firefox-atksuse | See advisory | 2.26.1-2.8.4 |
| firefox-atk-langsuse | See advisory | 2.26.1-2.8.4 |
| firefox-cairosuse | See advisory | 1.15.10-2.13.4 |
Patched Releases
firefox-atk
2.26.1-2.8.4
firefox-atk-lang
2.26.1-2.8.4
firefox-cairo
1.15.10-2.13.4
firefox-gdk-pixbuf
2.36.11-2.8.4
firefox-gdk-pixbuf-lang
2.36.11-2.8.4
firefox-gdk-pixbuf-query-loaders
2.36.11-2.8.4
firefox-gdk-pixbuf-thumbnailer
2.36.11-2.8.4
firefox-gio-branding-upstream
2.54.3-2.14.7
firefox-glib2
2.54.3-2.14.7
firefox-glib2-lang
2.54.3-2.14.7
firefox-glib2-tools
2.54.3-2.14.7
firefox-gtk3
3.10.9-2.15.3
firefox-gtk3-branding-upstream
3.10.9-2.15.3
firefox-gtk3-data
3.10.9-2.15.3
firefox-gtk3-immodule-amharic
3.10.9-2.15.3
firefox-gtk3-immodule-inuktitut
3.10.9-2.15.3
firefox-gtk3-immodule-multipress
3.10.9-2.15.3
firefox-gtk3-immodule-thai
3.10.9-2.15.3
firefox-gtk3-immodule-vietnamese
3.10.9-2.15.3
firefox-gtk3-immodule-xim
3.10.9-2.15.3
firefox-gtk3-immodules-tigrigna
3.10.9-2.15.3
firefox-gtk3-lang
3.10.9-2.15.3
firefox-gtk3-tools
3.10.9-2.15.3
firefox-harfbuzz
1.7.5-2.7.4
firefox-libatk-1_0-0
2.26.1-2.8.4
Timeline
Publicly disclosed
Sep 28, 2017
Last updated
Jul 8, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisoryhttps://bugzilla.suse.com/1000036
- advisoryhttps://bugzilla.suse.com/1001652
- advisoryhttps://bugzilla.suse.com/1025108
- advisoryhttps://bugzilla.suse.com/1029377
- advisoryhttps://bugzilla.suse.com/1029902
FAQ
Common Questions.
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Affected: Node.js (Nodejs) versions 8.5.0; nodejs (debian); firefox-atk (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including firefox-atk 2.26.1-2.8.4, firefox-atk-lang 2.26.1-2.8.4, firefox-cairo 1.15.10-2.13.4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-14849 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo