Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix

I found that Windows device names (CON, PRN, AUX, etc.) can still be used for path traversal attacks when working with UNC network paths, even after the CVE-2025-27210 patch. So basically, the fix only covered regular paths but missed the UNC path scenario when using `path.join()`

const path = require('path');

// This is fixed (regular path)
console.log(path.normalize('CON:../../secret.txt'));
// Output: .\CON:..\..\secret.txt ✓

// But this is still vulnerable (UNC path)
console.log(path.join('\\\\server\\share\\uploads', 'CON:../../secret.txt'));
// Output: …