Path Traversal Vulnerability in Node.js Tar Package by Isaac Schlueter

CVE-2026-24842

What is CVE-2026-24842?

The node-tar package for Node.js has a vulnerability that affects versions before 7.5.7. This flaw arises from a discrepancy between the security checks for hardlink entries and the actual logic for creating hardlinks. An attacker can exploit this weakness by crafting a malicious TAR archive that bypasses the path traversal protections, enabling the creation of hardlinks pointing to arbitrary files outside the designated extraction directory. Users are advised to update to version 7.5.7 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References