CVE-2026-23950
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The node-tar library (Tar for Node.js) versions up to and including 7.5.3 contain a race condition vulnerability due to incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems (e.g., macOS APFS), an attacker can exploit conflicting filenames (e.g., 'ß' and 'ss') to bypass concurrency locks and perform Symlink Poisoning attacks, leading to arbitrary file overwrite.
Risk Assessment
The organization is at risk of arbitrary file overwrite during extraction of a malicious tar archive, potentially leading to system compromise or data integrity violation, especially on macOS systems with APFS or HFS+ filesystems.
Recommendation
Upgrade node-tar to version 7.5.4 or later immediately. If an upgrade is not possible, as a temporary workaround, filter out all SymbolicLink entries when programmatically using node-tar to extract archives.
Other vulnerabilities in node-tar
See all- GHSA-r292-9mhp-454mMedium
Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.
- CVE-2026-73566High
node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.
- CVE-2026-59875Medium
The node-tar library before version 7.5.17 does not strip NUL bytes from PAX path and linkpath records, allowing a crafted archive to cause an uncaught exception and terminate the Node.js process.
- CVE-2026-59874High
The node-tar library before version 7.5.18 accepts a tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.
- CVE-2026-59873High
The node-tar library before version 7.5.19 does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio during extraction and parsing. This allows a small crafted gzip bomb to exhaust disk space and CPU.
- CVE-2026-59871Medium
The node-tar library before version 7.5.18 coerces all-digit PAX path and linkpath values to JavaScript numbers, causing a TypeError during path processing. The issue is fixed in version 7.5.18.
- CVE-2026-29786Medium
A vulnerability in node-tar prior to version 7.5.10 allows an attacker to create a hardlink pointing outside the extraction directory by using a drive-relative link target such as C:../target.txt. This enables file overwrite outside the current working directory during normal tar.x() extraction.
- CVE-2026-24842High
A vulnerability in node-tar (Tar for Node.js) prior to version 7.5.7 arises from a mismatch between the security check for hardlink entries and the actual hardlink creation logic. This allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory.
- CVE-2026-23745Medium
In node-tar library up to version 7.5.2, the linkpath of Link (hardlink) and SymbolicLink entries is not sanitized when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets.
Original NVD description (English source)
node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.