CVE-2026-24842 Details

A vulnerability exists in node-tar versions prior to 7.5.7, where the handling of hardlink entries introduces a path traversal issue. The security validation for hardlinks is inconsistent with the logic used to create them, allowing attackers to design a malicious TAR file that bypasses path traversal safeguards. This can result in hardlinks being created to arbitrary files outside the designated extraction directory. The vulnerability arises because the security check and hardlink creation process resolve paths differently, enabling exploitation by crafting specific linkpaths that escape the extraction directory.

Users should upgrade to node-tar version 7.5.7 or later, where this vulnerability has been fixed.