CVE-2026-29786

EUVD-2026-10164
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Affected Products (NVD)
VendorProductVersion
isaacstar
𝑥
< 7.5.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-tar
bookworm
no-dsa
bullseye
vulnerable
bullseye (security)
6.0.5+ds1+~cs11.3.9-1+deb11u3
fixed
forky
6.2.1+ds1+~cs6.1.13-10
fixed
sid
7.5.19+~4.0.1-1
fixed
trixie
6.2.1+~cs7.0.8-1+deb13u1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
nodejs20
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-debuginfo
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-debugsource
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-devel
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-docs
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-full-i18n
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-libs
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-libs-debuginfo
Amazon Linux 2023
1:20.20.1-1.amzn2023.0.2
fixed
nodejs20-npm
Amazon Linux 2023
1:10.8.2-1.20.20.1.1.amzn2023.0.2
fixed
nodejs22
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-debuginfo
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-debugsource
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-devel
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-docs
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-full-i18n
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-libs
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-libs-debuginfo
Amazon Linux 2023
1:22.22.1-1.amzn2023.0.1
fixed
nodejs22-npm
Amazon Linux 2023
1:10.9.4-1.22.22.1.1.amzn2023.0.1
fixed
nodejs24
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-debuginfo
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-debugsource
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-devel
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-docs
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-full-i18n
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-libs
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-libs-debuginfo
Amazon Linux 2023
1:24.15.0-1.amzn2023.0.1
fixed
nodejs24-npm
Amazon Linux 2023
1:11.12.1-1.24.15.0.1.amzn2023.0.1
fixed
v8-11.3-devel
Amazon Linux 2023
3:11.3.244.8-1.20.20.1.1.amzn2023.0.2
fixed
v8-12.4-devel
Amazon Linux 2023
3:12.4.254.21-1.22.22.1.1.amzn2023.0.1
fixed
v8-13.6-devel
Amazon Linux 2023
3:13.6.233.17-1.24.15.0.1.amzn2023.0.1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f
https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96
https://access.redhat.com/security/cve/CVE-2026-29786
https://bugzilla.redhat.com/show_bug.cgi?id=2445476
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json