Security vulnerabilities and automated fixes for node tar issues
10 posts found
A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in the node-tar package where attackers could craft malicious gzip archives that expand to consume all available system resources. This vulnerability affected version 7.5.15 of the tar package and was fixed by upgrading to version 7.5.19. The fix protects applications from resource exhaustion attacks when processing untrusted archive files.
CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` package (versions before 7.5.19) that allows an attacker to trigger resource exhaustion by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any Node.js application that processes tar archives. Because this package is used in production code — not just in tests — the exposure was real and immediate.
A medium-severity vulnerability (CVE-2026-24842) in node-tar allowed attackers to bypass hardlink security checks and create arbitrary files through path traversal attacks. This vulnerability, combined with improper configuration management storing JWT secrets in plaintext .env files, created a dangerous attack vector for token forgery and unauthorized access.
A medium-severity vulnerability (CVE-2026-24842) in node-tar allowed attackers to create arbitrary files outside intended directories by exploiting a hardlink security check bypass. This path traversal flaw could enable malicious actors to overwrite critical system files or plant backdoors when extracting specially crafted tar archives. The vulnerability has been patched, but highlights the ongoing challenges in securing file extraction operations.
A medium-severity vulnerability (CVE-2026-24842) in node-tar allowed attackers to create arbitrary files outside intended directories by exploiting a flaw in hardlink security checks. Combined with missing rate limiting controls, this vulnerability exposed applications to both path traversal attacks and denial-of-service through unlimited automated requests. Here's what happened and how to protect your applications.
A medium-severity path traversal vulnerability (CVE-2026-24842) was discovered in node-tar that allowed attackers to create arbitrary files outside intended directories by exploiting a flaw in the hardlink security check. This vulnerability could enable malicious actors to overwrite critical system files or inject malicious code by crafting specially designed tar archives. The fix has been deployed to prevent this hardlink-based directory escape attack.
A medium-severity path traversal vulnerability (CVE-2026-24842) in node-tar allowed attackers to create arbitrary files by bypassing hardlink security checks. This vulnerability could enable malicious actors to overwrite critical system files or inject malicious code during tar archive extraction. The recent security patch addresses this exploit vector, protecting applications that process untrusted tar archives.
A medium-severity vulnerability (CVE-2026-24842) in node-tar allowed attackers to bypass hardlink security checks through path traversal techniques, enabling arbitrary file creation and overwriting. This vulnerability could lead to symlink poisoning attacks and unauthorized file system manipulation when extracting malicious tar archives. The fix sanitizes linkpaths to prevent directory traversal exploitation.
A medium-severity vulnerability in node-tar (CVE-2026-24842) allowed attackers to create arbitrary files outside intended directories by exploiting Unicode path collisions in hardlink security checks. This race condition could enable malicious tar archives to overwrite critical system files, potentially leading to remote code execution or privilege escalation.
A medium-severity path traversal vulnerability (CVE-2026-24842) has been patched in the popular `node-tar` library. This fix prevents attackers from creating arbitrary files outside the intended extraction directory by exploiting a bypass in the hardlink security check, safeguarding countless Node.js projects that rely on it.