---
id: CVE-2026-23745
title: node-tar is a Tar for Node.js
summary: >-
  node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to
  sanitize the linkpath of Link (hardlink) and SymbolicLink entries when
  preservePaths is false (the default secure behavior). This allows malicious
  archives to bypass…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'
cwe:
  - CWE-22
vendor: isaacs
product: tar
affected:
  - tar < 7.5.3
patched:
  - tar 7.5.3
published: '2026-01-16'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23745'
references:
  - url: >-
      https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
    label: security-advisories@github.com
  - url: 'https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:18480'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:18868'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:19712'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2144'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2900'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2926'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3782'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:6192'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-23745'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2430538'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-23745'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23745'
  - url: 'https://access.redhat.com/errata/RHSA-2026:41928'
tags:
  - nvd
  - exploit-available
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00376
epssPercentile: 0.31389
ingestedAt: '2026-06-30T13:26:50.503Z'
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/Jvr2022/CVE-2026-23745'
    - 'https://github.com/Novem13th/CVE-2026-23745-via-graphql-DEMO'
    - 'https://github.com/OndrejDrapalik/node-tar-cve-demo'
  checkedAt: '2026-10-27T17:03:00.916Z'
exploitAvailable: true
scores:
  nvd: 6.1
  vendor: 8.2
---

## Overview

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.

## Affected

- `tar < 7.5.3`

## Remediation

Upgrade past the affected range:

- `tar 7.5.3`

## Vendor advisories

- **RHSA-2026:18480** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:18480)
- **RHSA-2026:18868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:18868)
- **RHSA-2026:2900** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.11.0 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2900)
- **RHSA-2026:41928** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41928)
- **RHSA-2026:3782** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3782)
- **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712)
- **RHSA-2026:6192** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.27 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6192)
- **RHSA-2026:2926** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.2 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2926)
- **RHSA-2026:2144** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.3 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2144)
- **Red Hat VEX** · Important · affected: Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, Red Hat 3scale API Management Platform 2, … · no fix planned: Red Hat Enterprise Linux 6, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, OpenShift Pipelines, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json)