CVE-2026-24842

Name
CVE-2026-24842
Description
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
security-advisories@github.com https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:18480
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:18868
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:2900
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:5447
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:6192
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/security/cve/CVE-2026-24842
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://bugzilla.redhat.com/show_bug.cgi?id=2433645
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:33371

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* tar >= None < 7.5.7
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* node-tar >= None < 7.5.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
tar edge-main 1.35-r5 qaqland <qaq@qaq.land> fixed
tar edge-main 1.35-r4 Celeste <cielesti@protonmail.com> fixed
tar edge-main 1.35-r3 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.35-r0 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.34-r4 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.34-r3 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.34-r2 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.34-r1 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.34-r0 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar edge-main 1.31-r0 None fixed
tar edge-main 1.29-r1 None fixed
tar 3.24-main 1.35-r5 qaqland <qaq@qaq.land> fixed
tar 3.23-main 1.35-r4 Celeste <cielesti@protonmail.com> fixed
tar 3.22-main 1.35-r3 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar 3.22-main 1.34-r2 None fixed
tar 3.22-main 1.34-r0 None fixed
tar 3.22-main 1.31-r0 None fixed
tar 3.22-main 1.29-r1 None fixed
tar 3.21-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar 3.21-main 1.34-r2 None fixed
tar 3.21-main 1.34-r0 None fixed
tar 3.21-main 1.31-r0 None fixed
tar 3.21-main 1.29-r1 None fixed
tar 3.20-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar 3.20-main 1.34-r2 None fixed
tar 3.20-main 1.34-r0 None fixed
tar 3.20-main 1.31-r0 None fixed
tar 3.20-main 1.29-r1 None fixed
tar 3.19-main 1.35-r2 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
tar 3.19-main 1.34-r2 None fixed
tar 3.19-main 1.34-r0 None fixed
tar 3.19-main 1.31-r0 None fixed
tar 3.19-main 1.29-r1 None fixed
pnpm 3.23-community 10.33.4-r0 Johannes Müller <alpinelinux@jogemu.at> fixed