CVE-2026-24842: node-tar Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Summary
CVE-2026-24842: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal. Affects tar versions < 7.5.7. Fixed in 7.5.7. How to fix ↓
Also tracked for
- tar · ghsa
The same CVE-2026-24842 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-tar is a widely used package in the Node.js ecosystem that facilitates the creation and extraction of TAR archives. It is designed to handle file compression and decompression efficiently, making it a popular choice for developers working with file systems. However, a critical vulnerability has been identified in node-tar that allows attackers to exploit the hardlink creation process, leading to potential security breaches.
Vulnerability Detail
The vulnerability in node-tar arises from a discrepancy in the path resolution logic used during security checks for hardlink entries and the actual hardlink creation process. This inconsistency allows attackers to craft malicious TAR archives that can bypass path traversal protections, resulting in the creation of hardlinks to arbitrary files outside the designated extraction directory. The implications of this vulnerability are severe, as it can lead to unauthorized access to sensitive files, data corruption, and even remote code execution if exploited effectively.
How To Fix
Latest published version: 7.5.22 as of 22 Oct 2026
npm install tar@7.5.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.5.7
This is the first release that contains the fix.
npm install tar@7.5.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate the paths of files being extracted from TAR archives, ensuring they do not lead outside the intended extraction directory. This can help prevent exploitation until the package is updated.
Conclusion
The node-tar package contains a critical vulnerability (CVE-2026-24842) that can lead to arbitrary file creation and overwriting through hardlink path traversal. It is essential to update to the patched version (7.5.7) to protect your application from potential exploits. Implementing additional path validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for tar →
FAQ
CVE-2026-24842 is a vulnerability in the node-tar package that allows arbitrary file creation and overwriting through hardlink path traversal.
An attacker can create a malicious TAR archive that, when extracted, creates hardlinks to sensitive files outside the extraction directory, potentially leading to data theft or corruption.
The impacts include unauthorized access to sensitive files, data corruption, and the possibility of remote code execution if the application writes to the hardlink path.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If immediate updates are not possible, implement additional path validation checks in your application to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
