CVE-2026-24842

NameCVE-2026-24842
Descriptionnode-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-tar (PTS)bullseye (security), bullseye6.0.5+ds1+~cs11.3.9-1+deb11u2fixed
bookworm6.1.13+~cs7.0.5-1fixed
trixie6.2.1+~cs7.0.8-1fixed
forky, sid6.2.1+ds1+~cs6.1.13-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-tarsource(unstable)(not affected)

Notes

- node-tar <not-affected> (Vulnerable code not present)
https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v
Fixed by: https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46 (v7.5.7)
Vulnerability introduced by the upstream fixes for CVE-2026-23745, i.e. upstream's
https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
https://github.com/isaacs/node-tar/commit/e9a1ddb821b29ddee75b9470dd511066148c8070

Search for package or bug name: Reporting problems