Description

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

INFO

Published Date :

2026-01-28T00:20:13.261Z

Last Modified :

2026-01-28T14:56:10.317Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-24842 vulnerability.

Vendors Products
Isaacs
  • Tar
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-24842.

URL Resource
https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46 cve-icon cve-icon cve-icon
https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-24842 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-24842 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact