path.isAbsolute()
Reports whether a path is absolute on the current platform.
path.isAbsolute(path)- Added in Node.js v0.11.2
Parameters
| Parameter | Type | Description |
|---|---|---|
$path | string | The path to test. |
Return value
booleantrue if the path is absolute, false otherwise. A zero-length string always returns false.
Errors
Throws a TypeError (ERR_INVALID_ARG_TYPE) if path is not a string.
path.isAbsolute() tells you whether a path is anchored to a filesystem root. On POSIX that means it begins with /. On Windows the rules are broader: a drive-rooted path such as C:\foo, a UNC path such as \\server\share, and a path beginning with a bare separator all count.
When to reach for it
Use it when a path arrives from outside your code and its shape decides what happens next — accepting a CLI argument that may be either absolute or relative to the working directory, deciding whether a config value needs resolving against a base directory, or validating that a value you were handed is already fully qualified.
What trips people up
The docs are explicit that this is not a defence against path traversal. path.isAbsolute('/baz/..') is true and path.isAbsolute('../../etc/passwd') is false, yet the second is precisely the input you were worried about. Containment is a resolve-then-relative question, not an absoluteness question.
It is also platform-dependent: path.isAbsolute('C:\\data') is false when the code runs on Linux, because the default export is the POSIX implementation there. Test cross-platform input with path.win32.isAbsolute() or path.posix.isAbsolute() explicitly.
An empty string is always false.
Example
When to use it
- Deciding whether a CLI path argument still needs resolving against the working directory
- Validating that a config value points somewhere fully qualified before using it
- Branching on whether a module specifier is a rooted path or a relative one
Frequently asked questions
How do I check if a path is absolute in Node.js?
Call path.isAbsolute(p), which returns true for a path anchored at a filesystem root. On POSIX that means a leading '/'; on Windows it also covers drive-rooted paths like 'C:\\foo' and UNC paths like '\\\\server\\share'. An empty string always returns false.
Can path.isAbsolute prevent directory traversal?
No, and the official docs say so explicitly. '../../etc/passwd' is not absolute yet is exactly the dangerous input, while '/baz/..' is absolute and harmless. To confine a path, resolve it against a root and check that path.relative(root, target) does not start with '..'.
Why does path.isAbsolute return false for a Windows path on Linux?
Because the default export of the path module is the POSIX implementation when running on Linux or macOS, and 'C:\\data' has no leading slash under those rules. Call path.win32.isAbsolute() explicitly when the string came from a Windows system.
More examples
Resolving a path only when it needs it
The guard lets a config value be written either way: a bare 'db.json' is interpreted relative to the config directory, while an already-absolute value is used untouched. path.resolve() would do the same thing on its own here, so use the explicit check when you need to branch on the distinction.
const path = require('node:path');
const base = path.resolve('config');
function anchor(value) {
return path.isAbsolute(value) ? value : path.resolve(base, value);
}
// print relative to cwd so the output is machine-independent
console.log(path.relative(process.cwd(), anchor('db.json')));
// -> config/db.json
console.log(path.relative(process.cwd(), anchor(path.resolve('elsewhere/db.json'))));
// -> elsewhere/db.jsonWhy it is not a security check
Both inputs are non-absolute, so isAbsolute() reports false for each and gives no signal at all about the traversal. The relative() column is the check that actually distinguishes them.
const path = require('node:path');
const root = path.resolve('uploads');
for (const input of ['ok.txt', '../../etc/passwd']) {
const target = path.resolve(root, input);
const rel = path.relative(root, target);
console.log(JSON.stringify(input).padEnd(20),
'isAbsolute(input):', path.isAbsolute(input),
'| actually inside root:', !rel.startsWith('..'));
}Platform-specific answers for the same string
'/srv/app' is absolute under both implementations, but the Windows forms are absolute only under win32 — on Linux the default export is posix, so a Windows path read from a manifest would be misclassified as relative. Name the implementation explicitly when the input may come from another platform.
const path = require('node:path');
const candidates = ['/srv/app', 'C:\\data', '\\\\server\\share', 'src/index.js'];
for (const p of candidates) {
console.log(JSON.stringify(p).padEnd(20),
'posix:', String(path.posix.isAbsolute(p)).padEnd(6),
'win32:', path.win32.isAbsolute(p));
}
Discussion