CVE-2026-23950

What it actually does

node-tar versions up to and including 7.5.3 contain a race condition in the PathReservations concurrency-control mechanism when extracting archives on case-insensitive or Unicode-normalization-insensitive filesystems, especially macOS APFS/HFS+. The library may treat Unicode-equivalent or filesystem-colliding paths, such as names involving ß and ss, as distinct reservations even though the filesystem resolves them to the same target. A malicious tar archive can exploit this mismatch with concurrent entries and symbolic links to bypass ordering safeguards, enabling symlink poisoning and arbitrary file overwrite during extraction. The vulnerability requires a victim application or user to extract attacker-controlled tar content in an affected runtime and filesystem context.

Why it matters to the business

Applications, developer tools, build systems, package-processing services, and desktop workflows that extract untrusted tar archives with vulnerable node-tar versions on macOS-like filesystems could overwrite files outside the intended extraction path or corrupt application data. In practical terms, this can lead to tampering with source code, build outputs, configuration files, credentials, or user-accessible files, depending on extraction privileges. The CVSS score is high, but current public exploit maturity and EPSS are low, and it is not listed in CISA KEV; prioritization should be highest where untrusted archives are processed automatically or where macOS hosts are used in CI, packaging, or developer workflows.

How an attack unfolds

An attacker prepares a tar archive containing pathnames that collide on the target filesystem after case folding or Unicode normalization but are not treated as the same path by vulnerable node-tar reservation logic. The archive includes a carefully ordered mix of regular files and symbolic link entries so that parallel extraction can cause a path safety check to occur before the effective filesystem target changes. When the archive is extracted on a vulnerable system, node-tar processes the colliding entries concurrently instead of serializing them under one reservation. The attacker wins the race by causing a symbolic link or colliding path to redirect a subsequent write, resulting in overwrite of an attacker-chosen file reachable by the extraction process. Exploitation depends on the target accepting or extracting attacker-controlled archives and is most relevant to macOS APFS/HFS+ or similarly normalization-insensitive filesystems.

How to fix it

Upgrade node-tar to version 7.5.4 or later, or consume the upstream fix at commit 911c886bb170a6ee3db05fd3709221752213ec8a. Regenerate lockfiles and redeploy affected applications, developer tooling, CI workers, and packaged products that bundle node-tar. If immediate upgrade is not possible, do not extract untrusted tar archives on affected filesystems, disable or reject symbolic link entries during extraction, and apply a strict archive-entry filter that rejects symlinks, hard links, absolute paths, parent-directory traversal, and suspicious Unicode/case-colliding names. Run archive extraction in a low-privilege sandbox or temporary isolated directory and copy out only validated regular files. Treat dependency updates as transitive: node-tar may be included indirectly through other JavaScript tooling, so software composition analysis and lockfile review are required.

How to confirm the fix worked

Confirm that all deployed dependency trees resolve node-tar/tar to 7.5.4 or later, or to a build containing commit 911c886bb170a6ee3db05fd3709221752213ec8a. Check package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, bundled node_modules directories, container images, desktop application bundles, and CI worker images. On macOS systems, validate filesystem exposure by identifying archive extraction paths on APFS/HFS+ volumes and reviewing whether untrusted tar input can reach vulnerable extraction code. Functional validation should include a safe regression test using a non-production harness that extracts archives with Unicode/case-colliding names and confirms that colliding paths are serialized or rejected and that symbolic link entries cannot redirect writes outside the extraction directory. Verify compensating controls by confirming symlink entries are filtered before extraction and that extraction runs with least privilege in isolated temporary directories.

Typical attack path

1. Identify an application, build pipeline, package ingestion process, or user workflow that extracts attacker-supplied tar archives using node-tar version 7.5.3 or earlier.
2. Confirm or assume the extraction occurs on a case-insensitive or Unicode-normalization-insensitive filesystem such as macOS APFS or HFS+.
3. Create a malicious tar archive containing Unicode/case-colliding pathnames that the filesystem maps to the same location but vulnerable node-tar does not reserve as the same path.
4. Include symbolic link entries and file entries designed to trigger a symlink poisoning race during parallel extraction.
5. Deliver the archive through an upload feature, dependency/package intake path, email/download workflow, CI artifact, or other archive-processing mechanism.
6. Wait for the victim process to extract the archive, causing node-tar to process colliding paths concurrently.
7. Use the race condition to redirect writes through a symlink or colliding path and overwrite a file accessible to the extraction process.

How to detect it

Detection should focus on archive ingestion and extraction telemetry because exploitation occurs during tar extraction rather than through a distinctive network protocol. Review application logs, upload logs, CI job logs, package-processing logs, endpoint file creation events, EDR telemetry, and filesystem audit logs around tar extraction events. Look for tar archives containing symbolic links combined with unusual Unicode filenames, visually similar pathnames, case-only differences, or names involving normalization-sensitive characters such as ß versus ss. Investigate unexpected file modifications immediately after archive extraction, especially writes outside intended temporary extraction directories, changes to configuration files, shell startup files, build scripts, package manifests, credentials, or application code. On macOS, correlate file events from APFS/HFS+ volumes with Node.js processes performing extraction. Forensic review should include preserving suspicious tar files and listing their entries with metadata so symbolic links, hard links, absolute paths, parent-directory traversal, and Unicode-colliding names can be inspected. Also search dependency inventories for vulnerable node-tar versions to determine whether any suspicious archive activity occurred while exposure existed.

• node_modules/tar/package.json
• "version": "7.5.3"
• "version":"7.5.3"
• "tar": "7.5.3"
• "tar":"7.5.3"
• package-lock.json
• npm-shrinkwrap.json
• yarn.lock
• pnpm-lock.yaml
• SymbolicLink
• SYMTYPE
• type: 'SymbolicLink'
• type: "SymbolicLink"
• ß
• ss

What your security team should do

• Inventory JavaScript applications, developer tools, CI/CD jobs, package-processing services, and desktop utilities that use node-tar directly or transitively.
• Prioritize upgrades for systems that extract untrusted or externally supplied tar archives, especially on macOS APFS/HFS+ hosts.
• Upgrade node-tar/tar to 7.5.4 or later and rebuild artifacts, containers, and packaged applications so the patched dependency is actually deployed.
• Where upgrades are delayed, block symbolic link and hard link entries during tar extraction and reject archive entries with absolute paths, parent traversal, or Unicode/case-colliding names.
• Run archive extraction in a sandboxed, low-privilege context and avoid extracting directly into sensitive source, configuration, home, or application directories.
• Add dependency scanning rules for node-tar/tar versions up to and including 7.5.3 in repositories, lockfiles, containers, and endpoint software inventories.
• Review recent archive-processing activity for suspicious symbolic link entries, Unicode-heavy filenames, unexpected overwrites, and modified configuration or build files following tar extraction.
• Because this is not currently in CISA KEV and has low EPSS, use risk-based prioritization, but do not defer remediation where automated untrusted archive extraction exists.