Skip to main content

Tar CVE-2026-23950

MEDIUM
Improper Handling of Unicode Encoding (CWE-176)
2026-01-20 security-advisories@github.com GHSA-r6q2-hw4h-h46w
RCE Node.js Apple Tar Isaacs
5.9
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Extract tar archive with Unicode path collisions
  2. Exploit
    Race condition bypasses path reservation locks
  3. Execution
    Create symlink to sensitive location
  4. Impact
    Symlink poisoning writes to unintended target

Vulnerability Assessment

Weakness
CWE
CWE-176
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Unicode normalization
Exploitation Conditions

node-tar versions ≤7.5.3 extracting archives on case-insensitive or normalization-insensitive filesystems (macOS APFS, Windows NTFS). User interaction required to initiate tar extraction of attacker-controlled archive.
Impact

CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Exploitable via local access. Public exploit/POC available.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to circumvent internal parallelization locks (PathReservations) using conflicting.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode normalization on case-insensitive filesystems like macOS APFS, where the path reservation system fails to serialize operations on colliding paths. Public exploit code exists for this vulnerability, enabling concurrent processing that bypasses internal safeguards. Node.js users and applications depending on vulnerable tar versions should update immediately, as attackers can leverage this to manipulate file operations during archive extraction.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 8.8

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. [CVSS 8.8 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

Affected Packages

npm tar fix: 7.5.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-176 (Improper Handling of Unicode Encoding). Affects Tar. node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., ß and ss), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink

Know when Tar gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

5
Severity Changed
Jun 30, 2026 - 03:23 NVD
HIGH MEDIUM
CVSS changed
Jun 30, 2026 - 03:23 NVD
8.8 (HIGH) 5.9 (MEDIUM)
PoC Detected
Feb 18, 2026 - 15:50 vuln.today
Public exploit code
Patch released
Feb 18, 2026 - 15:50 nvd
Patch available
CVE Published
Jan 20, 2026 - 01:15 nvd
HIGH 8.8

DescriptionNVD

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., ß and ss), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a PathReservations system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using NFD Unicode normalization (in which ß and ss are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which ß causes an inode collision with ss)). This enables an attacker to circumvent internal parallelization locks (PathReservations) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates path-reservations.js to use a normalization form that matches the target filesystem's behavior (e.g., NFKD), followed by first toLocaleLowerCase('en') and then toLocaleUpperCase('en'). As a workaround, users who cannot upgrade promptly, and who are programmatically using node-tar to extract arbitrary tarball data should filter out all SymbolicLink entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 51 npm packages depend on tar (45 direct, 6 indirect)

Ecosystem-wide dependent count for version 7.5.4.

Executive ViewAI

Why It Matters

Organizations using versions face significant risk from CVE-2026-23950 rated CVSS 8.8. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)NVD

cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*

More in Tar

View all
CVE-2016-6321 HIGH POC
7.5 Dec 09

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote atta
CVE-2026-24842 HIGH POC
8.2 Jan 28

node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution between validat
CVE-2026-29786 HIGH POC
8.2 Mar 07

Arbitrary file overwrite in node-tar before 7.5.10 lets a malicious tar archive write files outside the intended extract
CVE-2026-23745 HIGH POC
8.2 Jan 16

Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious tar archive

CVE-2021-38511 HIGH POC
7.5 Aug 10

An issue was discovered in the tar crate before 0.4.36 for Rust. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2021-32804 HIGH
8.1 Aug 03

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overw
CVE-2026-26960 HIGH POC
7.1 Feb 20

Path traversal in node-tar versions 7.5.7 and earlier allows local attackers to read and write arbitrary files outside t
CVE-2024-28863 MEDIUM POC
6.5 Mar 21

node-tar is a Tar for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenti
CVE-2021-32803 HIGH
8.1 Aug 03

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Over
CVE-2021-37701 HIGH
8.6 Aug 31

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite a
CVE-2018-20482 MEDIUM POC
4.7 Dec 26

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to c
CVE-2021-37713 HIGH
8.6 Aug 31

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite

Same weakness CWE-176 – Improper Handling of Unicode Encoding

View all
CVE-2025-71316 CRITICAL POC
9.2
CVE-2026-93990 HIGH POC
8.7
CVE-2026-25480 MEDIUM POC
6.5
CVE-2024-24691 CRITICAL
9.8
CVE-2023-39213 CRITICAL
9.8
CVE-2025-55129 MEDIUM POC
5.4
CVE-2023-41889 MEDIUM POC
5.3
CVE-2026-81869 MEDIUM POC
5.1

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected

References

Advisories & patches
PATCH https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6 ADVISORY https://access.redhat.com/errata/RHSA-2026:2144 ADVISORY https://access.redhat.com/errata/RHSA-2026:2926 ADVISORY https://access.redhat.com/errata/RHSA-2026:6192 ADVISORY https://vuldb.com/?id.341918 REF https://access.redhat.com/errata/RHSA-2026:18480 REF https://access.redhat.com/errata/RHSA-2026:18868 REF https://access.redhat.com/security/cve/CVE-2026-23950 REF https://bugzilla.redhat.com/show_bug.cgi?id=2431036 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23950.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy