CVE-2026-23950: Race Condition in node-tar Allows Symlink Poisoning on macOS APFS
Summary
CVE-2026-23950: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS. Affects tar versions < 7.5.4. Fixed in 7.5.4. How to fix ↓
Also tracked for
- tar · ghsa
The same CVE-2026-23950 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-tar is a widely used npm package that provides utilities for working with tar archives. It allows users to create, extract, and manipulate tar files in a straightforward manner. The package is designed to handle various file operations efficiently, ensuring that metadata checks and file operations are serialized to prevent race conditions. However, it is vulnerable to a race condition due to improper handling of Unicode path collisions, particularly on case-insensitive filesystems like macOS APFS.
Vulnerability Detail
A race condition exists in node-tar (v7.5.3) due to incomplete handling of Unicode path collisions in the path-reservations system. On macOS APFS, the library fails to lock colliding paths (e.g., 'ß' and 'ss'), allowing them to be processed in parallel. This bypasses internal concurrency safeguards, enabling Symlink Poisoning attacks through race conditions. The vulnerability arises because the library uses NFD Unicode normalization, which does not account for filesystem behaviors that ignore normalization, leading to potential arbitrary file overwrites.
How To Fix
Latest published version: 7.5.22 as of 22 Oct 2026
npm install tar@7.5.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.5.4
This is the first release that contains the fix.
npm install tar@7.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, filter out all SymbolicLink entries when using node-tar to extract tarball data. This can be done programmatically as follows:
const extract = new
tar.
Unpack({ cwd: exploitDir, filter: (file) => !file.type === 'SymbolicLink' });
Conclusion
The race condition vulnerability in node-tar poses a significant risk to users on macOS APFS, allowing for potential arbitrary file overwrites. It is crucial to update to the patched version or implement workarounds to safeguard against exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for tar →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Versions of node-tar up to and including 7.5.3 are affected by this vulnerability.
This vulnerability can enable Symlink Poisoning attacks, allowing an attacker to overwrite files arbitrarily.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If you cannot upgrade, implement a workaround by filtering out SymbolicLink entries during extraction to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tar.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.