node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-npmUpgrade nodejs24-debugsourceUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs20-full-i18nUpgrade nodejs22-debugsourceUpgrade v8-11.3-develUpgrade nodejs22-docsUpgrade nodejs22-develUpgrade nodejs20-libsUpgrade nodejs20-docsUpgrade nodejs22-libsUpgrade nodejs20-npmUpgrade nodejs20-debugsourceUpgrade nodejs20-debuginfoUpgrade nodejs20Upgrade nodejs24-develUpgrade nodejs20-develUpgrade nodejs24-debuginfoUpgrade nodejs22-full-i18nUpgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nodejs24-npmUpgrade nodejs24Upgrade nodejs22-libs-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs22Upgrade v8-12.4-devel | Mar 27, 2026 | Feb 20, 2026 |
| Debian | — | Upgrade node-tar | Apr 29, 2026 | Apr 29, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub