PT-2026-5047 · Node-Tar+2 · Node-Tar+2

Mistersiddd · Published 2026-01-27 · Updated 2026-05-19 · CVE-2026-24842

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.7

Description The node-tar software has an issue where the security check for hardlink entries uses different path resolution logic than the actual hardlink creation process. This discrepancy allows a malicious TAR archive to circumvent path traversal protections and create hardlinks to files outside the intended extraction directory.

Recommendations Update to version 7.5.7 or later.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

ALSA-2026:18480

ALSA-2026:18868

BDU:2026-00891

CLEANSTART-2026-AD27625

CLEANSTART-2026-CE10526

CLEANSTART-2026-DV49099

CLEANSTART-2026-NB51079

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CLEANSTART-2026-TZ34913

CVE-2026-24842

GHSA-34X7-HFP2-RC4V

OPENSUSE-SU-2026:10410-1

RHSA-2026:18868

Affected Products

Confluence

Rocky Linux

Node-Tar

References · 218

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24842.json · Exploit
• https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v · Vendor Advisory
• https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25128 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1527 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-33987 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41650 · Security Note
• https://bdu.fstec.ru/vul/2026-00891 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32280 · Security Note
• https://errata.almalinux.org/10/ALSA-2026-18480.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24842 · Vendor Advisory