Read the docs
TI-2026-20041 Aliases CVE-2026-24842GHSA-34x7-hfp2-rc4v

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Priority HIGH 69CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 6 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial node-tar (isaacs): 7.5.7tar (npm): 7.5.7Red Hat: 6 advisoriesRed Hat: 6 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isaacsnode-tarbefore 7.5.77.5.7Patch availableCNA
—tar (npm)before 7.5.77.5.7Patch availableGHSA-34x7-hfp2-rc4v
  • node-tar Vendorisaacs Affected before 7.5.7 Fixed in 7.5.7 Patch available CNA
  • tar (npm) Vendor— Affected before 7.5.7 Fixed in 7.5.7 Patch available GHSA-34x7-hfp2-rc4v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*before 7.5.7Vulnerableisaacs
  • cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* Versions before 7.5.7 Vulnerable ·isaacs

Remediation

  • Fix · CNA node-tar (isaacs) Fixed in 7.5.7
  • Fix · GHSA-34x7-hfp2-rc4v tar (npm) Fixed in 7.5.7 Advisory →

Red Hat 6 advisories

  • RHSA-2026:33371 Released 2026-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.18 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
  • RHSA-2026:18868 Released 2026-05-19 · Red Hat rating Important
    linux-sgx security update
    • Red Hat Enterprise Linux AppStream (v. 9) linux-sgx-2.26-7.el9, sgx-common-2.26-7.el9, sgx-libs-2.26-7.el9 +5
  • RHSA-2026:18480 Released 2026-05-19 · Red Hat rating Important
    linux-sgx security update
    • Red Hat Enterprise Linux AppStream (v. 10) linux-sgx-2.26-7.el10, sgx-common-2.26-7.el10, sgx-libs-2.26-7.el10 +5
Show 3 more Red Hat advisories
  • RHSA-2026:6192 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.0 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:5447 Released 2026-03-23 · Red Hat rating Important
    RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:18480
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:18868
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:33371
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:6192
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:5447
Not affected: 24 products
  • Cryostat 4
  • Multicluster Engine for Kubernetes
  • Network Observability (NETOBSERV) 1.11.0
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Openshift Data Foundation 4
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Apache Camel - HawtIO 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24842
  2. 2026-10-03 Alias added: GHSA-34x7-hfp2-rc4v
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
  • TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
  • TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
  • TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-19118 node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization CVSS 4.0HIGH 8.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences