node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1609 advisory.

    @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1,     @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range     expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library     attempts to eagerly generate every possible combination synchronously. Because the expansion grows     exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process.
    This issue has been patched in version 5.0.1. (CVE-2026-25547)

    A flaw was found in zlib. An attacker providing specially crafted input to the crc32_combine64 or     crc32_combine_gen64 functions could trigger an infinite loop within the x2nmodp function. This leads to     excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system.
    (CVE-2026-27171)

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a     hardlink that points outside the extraction directory by using a drive-relative link target such as     C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has     been patched in version 7.5.10. (CVE-2026-29786)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4552 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4552-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     April 29, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 6.0.5+ds1+~cs11.3.9-1+deb11u3     CVE ID         : CVE-2024-28863 CVE-2026-23745 CVE-2026-24842 CVE-2026-26960                      CVE-2026-29786 CVE-2026-31802

    Multiple vulnerabilities have been discovered in node-tar, a Node.js     module to read and write portable tar archives.

    CVE-2024-28863

       Generating a large number of sub-folders can consume memory on the        system and even crash the Node.js client within a few seconds using        a path with too many sub-folders inside.

    CVE-2026-23745

       When preservePaths is false, the linkpath of Link (hardlink) and        SymbolicLink entries fail to be sanitized, allowing malicious        archives to bypass the extraction root restriction, leading to        arbitrary file overwrites via hardlinks and symlink poisoning via        absolute symlink targets.

       The fix for this issue introduces multiple of the following        vulnerabilties.

    CVE-2026-24842

       The security check for hardlink entries allows an attacker to craft        a malicious TAR archive that bypasses path traversal protections and        creates hardlinks to arbitrary files outside the extraction        directory.

    CVE-2026-26960

       An attacker-controlled archive can create a hardlink inside the        extraction directory that points to a file outside the extraction        root, enabling arbitrary file read and write as the extracting user.

    CVE-2026-29786

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.

    CVE-2026-31802

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.


    For Debian 11 bullseye, these problems have been fixed in version     6.0.5+ds1+~cs11.3.9-1+deb11u3.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1483 advisory.

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a     hardlink that points outside the extraction directory by using a drive-relative link target such as     C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has     been patched in version 7.5.10. (CVE-2026-29786)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1484 advisory.

    A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been     rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation     leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of     an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the     public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue.
    The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the     affected component. (CVE-2025-5889)

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a     hardlink that points outside the extraction directory by using a drive-relative link target such as     C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has     been patched in version 7.5.10. (CVE-2026-29786)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a     hardlink that points outside the extraction directory by using a drive-relative link target such as     C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has     been patched in version 7.5.10. (CVE-2026-29786)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311307	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1609)	Nessus	Amazon Linux Local Security Checks	critical
310898	Debian dla-4552 : node-tar - security update	Nessus	Debian Local Security Checks	high
304295	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1483)	Nessus	Amazon Linux Local Security Checks	high
304285	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2026-1484)	Nessus	Amazon Linux Local Security Checks	high
301465	Linux Distros Unpatched Vulnerability : CVE-2026-29786	Nessus	Misc.	high

Detections

Analytics

CVE-2026-29786

high

Tenable Plugins

critical

high

high

high

high