Skip to content
fr Sign in
8.2 High

CVE-2026-23745 node-tar is a Tar for Node.js

Description

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

Affected products and versions

Product Affected versions Fixed in
node-tar 7.5 earliest → < 7.5.3 7.5.3
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Network Observability (NETOBSERV) 1.11.2 1771227650 earliest → < 1771227650 1771227650
Red Hat OpenShift AI 2.25 1772093424 earliest → < 1772093424 1772093424
Red Hat OpenShift AI 3.3 1779189627 earliest → < 1779189627 1779189627
Red Hat OpenShift Dev Spaces 3.27 1774451954 earliest → < 1774451954 1774451954
Red Hat Trusted Artifact Signer 1.2 1770739056 earliest → < 1770739056 1770739056
Red Hat Trusted Artifact Signer 1.3 1770107452 earliest → < 1770107452 1770107452
Show the 39 other branches
Product Affected versions Fixed in
Confidential Compute Attestation Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Migration Toolkit for Containers Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat Satellite 6 Versions not published
Cryostat 4 Versions not published
Multicluster Engine for Kubernetes Versions not published
Node HealthCheck Operator Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat AMQ Broker 7 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Hardened Images Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Migration Toolkit 1.8 1783690532 earliest → < 1783690532 1783690532
Network Observability (NETOBSERV) 1.11.1 1771227650 earliest → < 1771227650 1771227650
Network Observability (NETOBSERV) 1.11.0 1771227650 earliest → < 1771227650 1771227650
Red Hat Migration Toolkit for Containers 1.8 1783690532 earliest → < 1783690532 1783690532

References

Timeline

  1. Published
  2. Last modified

Other CVEs of node-tar

The 14 CVEs of node-tar →
CVE-2026-73566 node-tar is a tar archive manipulation library for Node.js 7.5 High CVE-2026-59871 node-tar is a tar archive manipulation library for Node.js 5.3 Medium CVE-2026-59874 node-tar is a tar archive manipulation library for Node.js 8.7 High CVE-2026-59873 node-tar is a tar archive manipulation library for Node.js 9.2 Critical
Track this CVE