Race Condition Vulnerability in Node.js Tar Library by Isaac Scheber

CVE-2026-23950

What is CVE-2026-23950?

The node-tar library for Node.js exhibits a race condition vulnerability due to inadequate handling of Unicode path collisions, affecting versions up to 7.5.3. This flaw allows attackers to exploit the library's PathReservations mechanism on case-insensitive filesystems, such as macOS APFS. By processing colliding paths (e.g., ß and ss) in parallel, an attacker can sidestep internal concurrency safeguards, leading to potential Symlink Poisoning attacks and arbitrary file overwrites. Users are encouraged to update to version 7.5.4, which modifies the normalization process to align with the underlying filesystem's behavior, or implement mitigations by filtering symbolic links when extracting data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References