---
id: CVE-2026-24842
title: >-
  node-tar,a Tar for Node.js, contains a vulnerability in versions prior to
  7.5.7 where the security check for hardlink entries uses different path
  resolution semantics than the actual hardlink creation logic
summary: >-
  node-tar,a Tar for Node.js, contains a vulnerability in versions prior to
  7.5.7 where the security check for hardlink entries uses different path
  resolution semantics than the actual hardlink creation logic. This mismatch
  allows an attac…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'
cwe:
  - CWE-22
  - CWE-59
  - CWE-59
vendor: isaacs
product: tar
affected:
  - tar < 7.5.7
patched:
  - tar 7.5.7
published: '2026-01-28'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-24842'
references:
  - url: >-
      https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46
    label: security-advisories@github.com
  - url: 'https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:18480'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:18868'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2900'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:33371'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:5447'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:6192'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-24842'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2433645'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00617
epssPercentile: 0.47348
ingestedAt: '2026-06-30T17:40:12.480Z'
---

## Overview

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

## Affected

- `tar < 7.5.7`

## Remediation

Upgrade past the affected range:

- `tar 7.5.7`