CVE-2026-24842: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-28 · updated 2026-09-07
Weakness: CWE-22

Description

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Affected products

isaacs node-tar: before 7.5.7 — fixed in 7.5.7
Npm Tar: before 7.5.7 — fixed in 7.5.7

How to fix

Upgrade to a fixed version: isaacs node-tar 7.5.7; Npm Tar 7.5.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-24842 or the next vulnerability affects your stack