Symlink Validation Bypass in tar-fs Affects Node.js File Handling
CVE-2025-59343

8.7HIGH

Key Information:

Vendor

Mafintosh

Status
Tar-fs
Vendor
CVE Published:
24 September 2025

What is CVE-2025-59343?

The tar-fs package suffers from a symlink validation bypass vulnerability, allowing attackers to exploit predictable destination directories within specific tarballs. This vulnerability can pose significant risks to how files are handled in Node.js applications. It is essential to upgrade to at least version 3.1.1, 2.1.4, or 1.16.6, where the issue has been patched. For users not immediately able to upgrade, a temporary workaround is to utilize the ignore option to avoid processing non-file and non-directory items.

Affected Version(s)

tar-fs >= 3.0.0, < 3.1.1 < 3.0.0, 3.1.1

tar-fs >= 2.0.0, < 2.1.3 < 2.0.0, 2.1.3

tar-fs < 1.16.5 < 1.16.5

References

https://github.com/mafintosh/tar-fs/security/advisories/G...
x_refsource_CONFIRM
https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-59343 : Symlink Validation Bypass in tar-fs Affects Node.js File Handling