CVE-2026-23745: node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-16 · updated 2026-09-07
Weakness: CWE-22

Description

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

Affected products

isaacs node-tar: before 7.5.3 — fixed in 7.5.3
Npm Tar: before 7.5.3 — fixed in 7.5.3

How to fix

Upgrade to a fixed version: isaacs node-tar 7.5.3; Npm Tar 7.5.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23745 or the next vulnerability affects your stack