CVE-2026-24842

Name
CVE-2026-24842
Description
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
security-advisories@github.com https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* tar >= None < 7.5.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
tar edge-main 1.35-r4 Celeste <cielesti@protonmail.com> possibly vulnerable
tar edge-main 1.35-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.35-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.34-r4 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.34-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.34-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.34-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.34-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar edge-main 1.31-r0 None possibly vulnerable
tar edge-main 1.29-r1 None possibly vulnerable
tar 3.23-main 1.35-r4 Celeste <cielesti@protonmail.com> possibly vulnerable
tar 3.22-main 1.35-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar 3.22-main 1.34-r2 None possibly vulnerable
tar 3.22-main 1.34-r0 None possibly vulnerable
tar 3.22-main 1.31-r0 None possibly vulnerable
tar 3.22-main 1.29-r1 None possibly vulnerable
tar 3.21-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar 3.21-main 1.34-r2 None possibly vulnerable
tar 3.21-main 1.34-r0 None possibly vulnerable
tar 3.21-main 1.31-r0 None possibly vulnerable
tar 3.21-main 1.29-r1 None possibly vulnerable
tar 3.20-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar 3.20-main 1.34-r2 None possibly vulnerable
tar 3.20-main 1.34-r0 None possibly vulnerable
tar 3.20-main 1.31-r0 None possibly vulnerable
tar 3.20-main 1.29-r1 None possibly vulnerable
tar 3.19-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
tar 3.19-main 1.34-r2 None possibly vulnerable
tar 3.19-main 1.34-r0 None possibly vulnerable
tar 3.19-main 1.31-r0 None possibly vulnerable
tar 3.19-main 1.29-r1 None possibly vulnerable