CVE-2026-26960highCWE-22

CVE-2026-26960: high-severity vulnerability in isaacs node-tar

node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

Published

Follow this CVE+ Monitor node-tar+ Monitor tar

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.3%
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
isaacs · node-tar
Related CVEs — isaacs node-tar

In the same product, most dangerous first.

CVE-2024-28863MEDIUMnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationEPSS 0.9%CVE-2026-59871MEDIUMnode-tar: Process crash via PAX numeric path type confusionEPSS 0.6%CVE-2026-24842HIGHnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalEPSS 0.6%CVE-2026-59873CRITICALnode-tar: Decompression/parse DoS via unlimited inputEPSS 0.6%CVE-2026-73566HIGHnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionEPSS 0.5%CVE-2026-29786HIGHnode-tar: Hardlink Path Traversal via Drive-Relative LinkpathEPSS 0.5%