tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added
    to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or
    template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns
    falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String
    coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that
    escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's
    privileges. This affects any application that forwards untrusted request data (a common pattern is JSON
    body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync,
    tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability
    is fixed in 0.2.7. (CVE-2026-49982)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added     to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or     template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns     falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String     coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that     escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's     privileges. This affects any application that forwards untrusted request data (a common pattern is JSON     body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync,     tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability     is fixed in 0.2.7. (CVE-2026-49982)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
443215	SCA: security update for tmp (GHSA-7c78-jf6q-g5cm)	Tenable Cloud Security	SCA Checks	Local	high
443215	SCA: security update for tmp (GHSA-7c78-jf6q-g5cm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
320905	Linux Distros Unpatched Vulnerability : CVE-2026-49982	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-49982

high

Tenable Plugins

high

high

high