p PatchFirst

CVE-2026-24842

CVE-2026-24842 · node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

This page contains facts from public vulnerability sources. Check the original advisory before updating.

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

CVSS 8.2 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node-tar

    Versions
    • < 7.5.7: Affected

    No fix published

  • node-tar Debian:14

    Versions
    • 6.2.1+ds1+~cs6.1.13-1
    • 6.2.1+ds1+~cs6.1.13-2
    • 6.2.1+ds1+~cs6.1.13-3
    • 6.2.1+ds1+~cs6.1.13-4
    • 6.2.1+ds1+~cs6.1.13-5
    • 6.2.1+ds1+~cs6.1.13-6
    • 6.2.1+ds1+~cs6.1.13-7
    • 6.2.1+ds1+~cs6.1.13-8
    • 6.2.1+ds1+~cs6.1.13-9
    • 6.2.1+~cs7.0.8-1
    Affected ranges
    • ECOSYSTEM: < 6.2.1+ds1+~cs6.1.13-10

    Update to 6.2.1+ds1+~cs6.1.13-10

  • tar npm

    Affected ranges
    • SEMVER: < 7.5.7

    Update to 7.5.7

  • node-tar Ubuntu:Pro:14.04:LTS

    Versions
    • 0.1.18-1
    • 0.1.18-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.3-2
    • 1.0.3-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:18.04:LTS

    Versions
    • 2.2.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:Pro:20.04:LTS

    Versions
    • 4.4.10+ds1-2
    • 4.4.10+ds1-2ubuntu1
    • 4.4.10+ds1-2ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:22.04:LTS

    Versions
    • 6.1.7+~cs11.3.10-1
    • 6.1.11+~cs11.3.10-1
    • 6.1.11+ds1+~cs6.0.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:24.04:LTS

    Versions
    • 6.1.13+~cs7.0.5-1
    • 6.1.13+~cs7.0.5-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:25.10

    Versions
    • 6.2.1+~cs7.0.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:26.10

    Versions
    • 6.2.1+ds1+~cs6.1.13-10
    • 7.5.22+~4.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-tar Ubuntu:26.04:LTS

    Versions
    • 6.2.1+~cs7.0.8-1
    • 6.2.1+ds1+~cs6.1.13-6
    • 6.2.1+ds1+~cs6.1.13-7
    • 6.2.1+ds1+~cs6.1.13-10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →