node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4552 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4552-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     April 29, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 6.0.5+ds1+~cs11.3.9-1+deb11u3     CVE ID         : CVE-2024-28863 CVE-2026-23745 CVE-2026-24842 CVE-2026-26960                      CVE-2026-29786 CVE-2026-31802

    Multiple vulnerabilities have been discovered in node-tar, a Node.js     module to read and write portable tar archives.

    CVE-2024-28863

       Generating a large number of sub-folders can consume memory on the        system and even crash the Node.js client within a few seconds using        a path with too many sub-folders inside.

    CVE-2026-23745

       When preservePaths is false, the linkpath of Link (hardlink) and        SymbolicLink entries fail to be sanitized, allowing malicious        archives to bypass the extraction root restriction, leading to        arbitrary file overwrites via hardlinks and symlink poisoning via        absolute symlink targets.

       The fix for this issue introduces multiple of the following        vulnerabilties.

    CVE-2026-24842

       The security check for hardlink entries allows an attacker to craft        a malicious TAR archive that bypasses path traversal protections and        creates hardlinks to arbitrary files outside the extraction        directory.

    CVE-2026-26960

       An attacker-controlled archive can create a hardlink inside the        extraction directory that points to a file outside the extraction        root, enabling arbitrary file read and write as the extracting user.

    CVE-2026-29786

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.

    CVE-2026-31802

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.


    For Debian 11 bullseye, these problems have been fixed in version     6.0.5+ds1+~cs11.3.9-1+deb11u3.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1578 advisory.

    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-
    __proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---     high (CVE-2026-21710)

    A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called     with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js     process.

    This vulnerability affects 24.x and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#assertion-error-in-node_urlcc-     via-malformed-url-format-leads-to-nodejs-crash-cve-2026-21712---medium (CVE-2026-21712)

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values.

    Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this     is an oversight rather than an intentional design decision.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-     verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium     (CVE-2026-21713)

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 231-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

    This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-     http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium     (CVE-2026-21714)

    A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the     required read permission checks, while all comparable filesystem functions correctly enforce them. As a     result, code running under --permission with restricted --allow-fs-read can still use     fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths     outside of permitted directories.This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the     Permission Model where --allow-fs-read is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-     realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low (CVE-2026-21715)

    An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API     without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown())     were correctly patched.

    As a result, code running under --permission with restricted --allow-fs-write can still use promise-based     FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing     the intended write restrictions.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-     fs-write is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---     filehandlechmodchown-cve-2026-21716---low (CVE-2026-21716)

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value,     making hash collisions trivially predictable. By crafting a request that causes many such collisions in     V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

    The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON     parsing automatically internalizes short strings into the affected hash table.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717
    ---medium (CVE-2026-21717)

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1483 advisory.

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a     hardlink that points outside the extraction directory by using a drive-relative link target such as     C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has     been patched in version 7.5.10. (CVE-2026-29786)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1484 advisory.

    A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been     rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation     leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of     an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the     public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue.
    The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the     affected component. (CVE-2025-5889)

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a     hardlink that points outside the extraction directory by using a drive-relative link target such as     C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has     been patched in version 7.5.10. (CVE-2026-29786)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310898	Debian dla-4552 : node-tar - security update	Nessus	Debian Local Security Checks	high
306235	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1578)	Nessus	Amazon Linux Local Security Checks	high
304295	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1483)	Nessus	Amazon Linux Local Security Checks	high
304285	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2026-1484)	Nessus	Amazon Linux Local Security Checks	high
299677	Linux Distros Unpatched Vulnerability : CVE-2026-26960	Nessus	Misc.	high

Detections

Analytics

CVE-2026-26960

high

Tenable Plugins

high

high

high

high

high