It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1466 advisory.

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link     (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows     malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via     hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
    (CVE-2026-23745)

    node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This     is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-     insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested),     the library fails to lock colliding paths (e.g., `ss` and `ss`), allowing them to be processed in     parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning     attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks     and file operations for the same path are serialized. This prevents race conditions where one entry might     clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This     vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD`     Unicode normalization (in which `ss` and `ss` are different), conflicting paths do not have their order     properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ss` causes     an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks     (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version     7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's     behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`.
    As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to     extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend     against arbitrary file writes via this file system entry name collision issue. (CVE-2026-23950)

    node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check     for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
    This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections     and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix     for the issue. (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18480 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1143:03 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)
      * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)
      * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)
      * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)
      * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16528 advisory.

  - node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link     (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows     malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via     hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
    (CVE-2026-23745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4552 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4552-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     April 29, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 6.0.5+ds1+~cs11.3.9-1+deb11u3     CVE ID         : CVE-2024-28863 CVE-2026-23745 CVE-2026-24842 CVE-2026-26960                      CVE-2026-29786 CVE-2026-31802

    Multiple vulnerabilities have been discovered in node-tar, a Node.js     module to read and write portable tar archives.

    CVE-2024-28863

       Generating a large number of sub-folders can consume memory on the        system and even crash the Node.js client within a few seconds using        a path with too many sub-folders inside.

    CVE-2026-23745

       When preservePaths is false, the linkpath of Link (hardlink) and        SymbolicLink entries fail to be sanitized, allowing malicious        archives to bypass the extraction root restriction, leading to        arbitrary file overwrites via hardlinks and symlink poisoning via        absolute symlink targets.

       The fix for this issue introduces multiple of the following        vulnerabilties.

    CVE-2026-24842

       The security check for hardlink entries allows an attacker to craft        a malicious TAR archive that bypasses path traversal protections and        creates hardlinks to arbitrary files outside the extraction        directory.

    CVE-2026-26960

       An attacker-controlled archive can create a hardlink inside the        extraction directory that points to a file outside the extraction        root, enabling arbitrary file read and write as the extracting user.

    CVE-2026-29786

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.

    CVE-2026-31802

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.


    For Debian 11 bullseye, these problems have been fixed in version     6.0.5+ds1+~cs11.3.9-1+deb11u3.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link     (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows     malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via     hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
    (CVE-2026-23745)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4712 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4712-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     August 01, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 6.1.13+~cs7.0.5-1+deb12u1     CVE ID         : CVE-2024-28863 CVE-2026-23745 CVE-2026-26960 CVE-2026-29786

    Multiple vulnerabilities have been discovered in node-tar, a Node.js     module to read and write portable tar archives.

    CVE-2024-28863

       Generating a large number of sub-folders can consume memory on the        system and even crash the Node.js client within a few seconds using        a path with too many sub-folders inside.

    CVE-2026-23745

       When preservePaths is false, the linkpath of Link (hardlink) and        SymbolicLink entries fail to be sanitized, allowing malicious        archives to bypass the extraction root restriction, leading to        arbitrary file overwrites via hardlinks and symlink poisoning via        absolute symlink targets.

       The fix for this issue introduces CVE-2026-24842 and CVE-2026-31802.
       Both have been fixed subsequently.


    CVE-2026-26960

       An attacker-controlled archive can create a hardlink inside the        extraction directory that points to a file outside the extraction        root, enabling arbitrary file read and write as the extracting user.

    CVE-2026-29786

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.

    For Debian 12 bookworm, these problems have been fixed in version     6.1.13+~cs7.0.5-1+deb12u1.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18868 advisory.

    [2.26-7]
    - Fix pccs npm security flaws

    [2.26-6]
    - Port to pycryptography and pyasn1 and make keyring optional

    [2.26-5]
    - Sync specfile changes from Fedora

    [2.26-4]
    - Drop sgx-mpa dep from sgx-pccs

    [2.26-3]
    - Add scriptlets for PCCS

    [2.26-2]
    - Enable pccsadmin everywhere

    [2.26-1]
    - Update to SGX 2.26 / DCAP 1.23, adding PCCS service

    [2.25-7]
    - Trigger udev to set perms on /dev/sgx_provision

    [2.25-6]
    - Temporarily disable automatic tier1 gating

    [2.25-5]
    - Adapt qgs.service for SELinux policy and sock perms

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f601b2f60a advisory.

    Update to version 20.20.0

    ----

    Update to version 20.19.6




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18480 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18868 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18868 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
301345	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1466)	Nessus	Amazon Linux Local Security Checks	3/6/2026	3/6/2026	high
317966	RockyLinux 10 : linux-sgx (RLSA-2026:18480)	Nessus	Rocky Linux Local Security Checks	5/29/2026	5/29/2026	high
325184	MiracleLinux 9 : linux-sgx-2.26-7.el9 (AXSA:2026-1143:03)	Nessus	Miracle Linux Local Security Checks	7/6/2026	7/6/2026	high
304691	Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.18 / 10.4.x < 11.3.3 (JSDSERVER-16528)	Nessus	Misc.	4/2/2026	4/2/2026	high
310898	Debian dla-4552 : node-tar - security update	Nessus	Debian Local Security Checks	4/29/2026	4/29/2026	high
291301	Linux Distros Unpatched Vulnerability : CVE-2026-23745	Nessus	Misc.	1/17/2026	8/2/2026	high
331606	Debian dla-4712 : node-tar - security update	Nessus	Debian Local Security Checks	8/2/2026	8/2/2026	high
322200	Oracle Linux 9 : linux-sgx (ELSA-2026-18868)	Nessus	Oracle Linux Local Security Checks	6/23/2026	6/23/2026	high
297442	Fedora 43 : nodejs20 (2026-f601b2f60a)	Nessus	Fedora Local Security Checks	1/31/2026	4/3/2026	high
315307	RHEL 10 : linux-sgx (RHSA-2026:18480)	Nessus	Red Hat Local Security Checks	5/19/2026	5/19/2026	high
315374	RHEL 9 : linux-sgx (RHSA-2026:18868)	Nessus	Red Hat Local Security Checks	5/19/2026	5/19/2026	high
317439	RockyLinux 9 : linux-sgx (RLSA-2026:18868)	Nessus	Rocky Linux Local Security Checks	5/28/2026	5/28/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high