CVE-2019-13173: Arbitrary File Overwrite in fstream
Summary
CVE-2019-13173: Arbitrary File Overwrite in fstream. Affects fstream versions < 1.0.12. Fixed in 1.0.12. How to fix ↓
Also tracked for
- node-fstream · Debian:11
The same CVE-2019-13173 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fstream package is an npm module that provides file system streaming for Node.js. It allows users to read from and write to files and directories in a streaming manner. The package is widely used in various Node.js applications for file manipulation tasks.
Vulnerability Detail
Versions of fstream prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. When extracting tarballs that contain a hardlink to a file already existing in the system, and a file in the tarball matches the hardlink, the system's file will be overwritten with the contents of the extracted file. The vulnerable function in the package is fstream.DirWriter(). This vulnerability can lead to unauthorized modification or deletion of critical files on the system, potentially causing data loss or unauthorized access.
How To Fix
Latest published version: 1.0.12 as of 22 Oct 2026
npm install fstream@1.0.12The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The fstream package prior to version 1.0.12 is vulnerable to Arbitrary File Overwrite, which can result in unauthorized modification or deletion of critical files on the system. It is crucial to upgrade to version 1.0.12 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fstream →
FAQ
This vulnerability allows an attacker to overwrite existing files on the system, potentially leading to data loss or unauthorized access.
Versions prior to 1.0.12 of the fstream package are affected.
The vulnerable function is fstream.DirWriter().
No, upgrading to version 1.0.12 or later is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-xf7w-r453-m56c/GHSA-xf7w-r453-m56c.json
