CVE-2026-23950: node-tar Arbitrary File Overwrite via Unicode Path Collision
Summary
CVE-2026-23950: node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition. Affects tar versions < 7.5.4. Fixed in 7.5.4. How to fix ↓
Also tracked for
- tar · npm
The same CVE-2026-23950 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-tar is a Tar implementation for Node.js, designed to handle tar file creation and extraction. It is widely used in various Node.js applications for packaging and distributing files. The package provides essential functionalities for managing tar archives, but it has been found vulnerable to a race condition that can lead to arbitrary file overwrites under specific conditions, particularly on case-insensitive filesystems like macOS APFS.
Vulnerability Detail
The vulnerability arises from an incomplete handling of Unicode path collisions in the path-reservations system of node-tar. This race condition allows an attacker to exploit the library's internal concurrency safeguards by creating conflicting filenames within a malicious tar archive. On filesystems that ignore Unicode normalization, such as APFS, this can lead to symlink poisoning attacks, where an attacker can overwrite arbitrary files. The vulnerability affects versions up to and including 7.5.3, with a CVSS score of 8.8 indicating a high severity level.
How To Fix
Minimum fixed version
7.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, a temporary workaround is to filter out all SymbolicLink entries when programmatically using node-tar to extract tarball data. This can be done by implementing a check in your extraction code to skip symbolic links, similar to how npm handles it.
Conclusion
The CVE-2026-23950 vulnerability in node-tar poses a significant risk due to its potential for arbitrary file overwrites via Unicode path collisions. Users are strongly advised to update to the patched version 7.5.4 or implement the provided workaround to safeguard their systems.
See every vulnerability recorded for tar →
FAQ
The vulnerability is a race condition that allows arbitrary file overwrites due to improper handling of Unicode path collisions.
Versions up to and including 7.5.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
It is recommended to update to version 7.5.4 or later to mitigate the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for tar.
