Skip to main content

node-tmp EUVDEUVD-2026-36265

| CVE-2026-49982 HIGH
Improper Input Validation (CWE-20)
2026-06-11 GitHub_M GHSA-7c78-jf6q-g5cm
Authentication Bypass Node.js Node Tmp Suse
8.2
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
vuln.today AI
8.2 HIGH

Reachable over the network with no auth or interaction when an app forwards request data into tmp options; arbitrary file/dir creation gives high integrity and low availability impact, no direct confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Jun 11, 2026 - 17:15 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 90 npm packages depend on tmp (14 direct, 76 indirect)

Ecosystem-wide dependent count for version 0.2.6.

DescriptionCVE.org

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.

Articles & Coverage 2

News 3 New Node.js Vulnerabilities - 3 High Severity Jun 12, 2026 News 3 New Node.js Vulnerabilities - 3 High Severity Jun 11, 2026

AnalysisAI

Path traversal in node-tmp 0.2.6 allows remote attackers to create files or directories outside the temp directory by supplying non-string prefix, postfix, or template values (arrays, Buffers, or objects) whose includes('..') check returns falsy but whose string coercion contains ../. The 0.2.6 _assertPath guard checks only strings, so JSON body fields or qs-parsed bracket arrays such as ?prefix[]=.. bypass it and write at attacker-controlled paths with host-process privileges. No public exploit identified at time of analysis, but the bypass pattern is trivial and the library is widely used in Node.js applications.

Technical ContextAI

The tmp package (raszi/node-tmp) is a widely depended-on Node.js library for creating temporary files and directories, used directly and transitively by many build tools and servers. The fix in 0.2.6 introduced a string-only _assertPath guard that calls .includes('..') on the user-supplied prefix/postfix/template options. Because JavaScript's Array.prototype.includes and Buffer.prototype.includes perform element/byte comparisons rather than substring matching, an array like ['..','etc','passwd'] or a Buffer containing ../ returns false from includes('..') and passes the guard. The value then reaches _generateTmpName, where Array.prototype.join or implicit String() coercion turns it back into a ../-bearing string, and path.join(tmpDir, opts.dir, name) resolves the traversal - classic CWE-20 improper input validation enabling out-of-temp-dir file/directory creation. Affected CPE is cpe:2.3:a:raszi:node-tmp:*:*:*:*:*:*:*:* at version 0.2.6.

RemediationAI

Vendor-released patch: upgrade tmp to 0.2.7 or later (npm install tmp@^0.2.7) and refresh package-lock.json / yarn.lock; also audit transitive dependencies with npm ls tmp and force-resolve via overrides (npm) or resolutions (Yarn/pnpm) where older versions are pinned by indirect deps - see GHSA-7c78-jf6q-g5cm at https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm. If immediate upgrade is impossible, explicitly coerce prefix, postfix, and template to strings (String(value)) before passing them into any tmp.* API, and reject values whose stringification contains .. or path separators; the trade-off is that this requires touching every call site and missing one re-opens the bug. As a defense-in-depth layer, disable qs's bracket-array parsing (e.g. express's query parser: 'simple' or qs { parseArrays: false }) and validate request bodies with a schema library (Zod, Joi, ajv) that enforces string types on any field that reaches tmp - the side effect is that legitimate clients relying on array query parameters will need to change their request format.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2015-5688 MEDIUM POC
5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2
CVE-2012-1723 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-36265 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy