node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4552 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4552-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     April 29, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 6.0.5+ds1+~cs11.3.9-1+deb11u3     CVE ID         : CVE-2024-28863 CVE-2026-23745 CVE-2026-24842 CVE-2026-26960                      CVE-2026-29786 CVE-2026-31802

    Multiple vulnerabilities have been discovered in node-tar, a Node.js     module to read and write portable tar archives.

    CVE-2024-28863

       Generating a large number of sub-folders can consume memory on the        system and even crash the Node.js client within a few seconds using        a path with too many sub-folders inside.

    CVE-2026-23745

       When preservePaths is false, the linkpath of Link (hardlink) and        SymbolicLink entries fail to be sanitized, allowing malicious        archives to bypass the extraction root restriction, leading to        arbitrary file overwrites via hardlinks and symlink poisoning via        absolute symlink targets.

       The fix for this issue introduces multiple of the following        vulnerabilties.

    CVE-2026-24842

       The security check for hardlink entries allows an attacker to craft        a malicious TAR archive that bypasses path traversal protections and        creates hardlinks to arbitrary files outside the extraction        directory.

    CVE-2026-26960

       An attacker-controlled archive can create a hardlink inside the        extraction directory that points to a file outside the extraction        root, enabling arbitrary file read and write as the extracting user.

    CVE-2026-29786

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.

    CVE-2026-31802

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.


    For Debian 11 bullseye, these problems have been fixed in version     6.0.5+ds1+~cs11.3.9-1+deb11u3.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16529 advisory.

  - node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check     for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
    This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections     and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix     for the issue. (CVE-2026-24842)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1466 advisory.

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link     (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows     malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via     hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
    (CVE-2026-23745)

    node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This     is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-     insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested),     the library fails to lock colliding paths (e.g., `ss` and `ss`), allowing them to be processed in     parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning     attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks     and file operations for the same path are serialized. This prevents race conditions where one entry might     clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This     vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD`     Unicode normalization (in which `ss` and `ss` are different), conflicting paths do not have their order     properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ss` causes     an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks     (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version     7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's     behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`.
    As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to     extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend     against arbitrary file writes via this file system entry name collision issue. (CVE-2026-23950)

    node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check     for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
    This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections     and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix     for the issue. (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a84e0ad039 advisory.

    Update nodejs modules used by pccs daemon for CVE-2026-23745, CVE-2026-23950, CVE-2026-24842,     CVE-2025-13465, CVE-2025-15284.
    Remove Fedora override of default pccs daemon port.
    Remove redundant dep on mpa_registration from pccs.
    Add system scriptlets for pccs server.
    Port to pycryptography & pyasn1.
    Fix tracebacks in keyring code.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check     for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
    This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections     and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix     for the issue. (CVE-2026-24842)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310898	Debian dla-4552 : node-tar - security update	Nessus	Debian Local Security Checks	high
305912	Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.18 / 10.4.x < 11.3.3 (JSDSERVER-16529)	Nessus	Misc.	high
301345	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1466)	Nessus	Amazon Linux Local Security Checks	high
299072	Fedora 43 : linux-sgx (2026-a84e0ad039)	Nessus	Fedora Local Security Checks	high
297040	Linux Distros Unpatched Vulnerability : CVE-2026-24842	Nessus	Misc.	high

Detections

Analytics

CVE-2026-24842

high

Tenable Plugins

high

high

high

high

high