Race Condition Vulnerability in Node.js Tar Library by Isaac Scheber
CVE-2026-23950

8.8HIGH

Key Information:

Vendor

Isaacs

Status
Node-tar
Vendor
CVE Published:
20 January 2026

What is CVE-2026-23950?

The node-tar library for Node.js exhibits a race condition vulnerability due to inadequate handling of Unicode path collisions, affecting versions up to 7.5.3. This flaw allows attackers to exploit the library's PathReservations mechanism on case-insensitive filesystems, such as macOS APFS. By processing colliding paths (e.g., ß and ss) in parallel, an attacker can sidestep internal concurrency safeguards, leading to potential Symlink Poisoning attacks and arbitrary file overwrites. Users are encouraged to update to version 7.5.4, which modifies the normalization process to align with the underlying filesystem's behavior, or implement mitigations by filtering symbolic links when extracting data.

Affected Version(s)

node-tar < 7.5.4

References

https://github.com/isaacs/node-tar/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/isaacs/node-tar/commit/3b1abfae650056e...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.