---
id: CVE-2026-23745
title: node-tar is a Tar for Node.js
summary: >-
  node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to
  sanitize the linkpath of Link (hardlink) and SymbolicLink entries when
  preservePaths is false (the default secure behavior). This allows malicious
  archives to bypass…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'
cwe:
  - CWE-22
  - CWE-22
vendor: isaacs
product: tar
affected:
  - tar < 7.5.3
patched:
  - tar 7.5.3
published: '2026-01-16'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23745'
references:
  - url: >-
      https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
    label: security-advisories@github.com
  - url: 'https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:18480'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:18868'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:19712'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2144'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2900'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2926'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3782'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:6192'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-23745'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2430538'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
  - exploit-available
epss: 0.00382
epssPercentile: 0.3193
ingestedAt: '2026-06-30T13:26:50.503Z'
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/Jvr2022/CVE-2026-23745'
    - 'https://github.com/Novem13th/CVE-2026-23745-via-graphql-DEMO'
    - 'https://github.com/OndrejDrapalik/node-tar-cve-demo'
  checkedAt: '2026-09-21T15:28:30.501Z'
exploitAvailable: true
---

## Overview

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

## Affected

- `tar < 7.5.3`

## Remediation

Upgrade past the affected range:

- `tar 7.5.3`