CVE-2026-29786

What it actually does

CVE-2026-29786 is a path traversal/file overwrite flaw in the Node.js tar package before version 7.5.10. During normal tar.x() extraction, a crafted archive can define a hardlink whose link target uses a drive-relative Windows-style path such as C:../target.txt. The extraction logic can treat this as acceptable while the operating system resolves it outside the intended extraction directory, allowing the archive to create or overwrite files outside the configured current working directory. The vulnerability requires a victim process or user to extract attacker-controlled tar content, but it does not require attacker authentication once the malicious archive is processed.

Why it matters to the business

Systems, build pipelines, developer workstations, package-processing services, or applications that extract untrusted tar archives with vulnerable node-tar versions may allow an attacker to overwrite files outside the expected extraction location. In practical terms, this can corrupt application data, modify configuration, poison build artifacts, replace scripts, or set up later code execution if the overwritten file is subsequently trusted or executed. The current EPSS score is low and there is no CISA KEV listing or known ransomware association, but the package is commonly used in JavaScript tooling, so exposure can be widespread through direct or transitive dependencies.

How an attack unfolds

An attacker prepares a malicious tar archive containing a hardlink entry with a drive-relative target such as C:../target.txt. The attacker then causes a vulnerable application, build job, package importer, deployment tool, or user workflow to extract that archive using node-tar prior to 7.5.10. During extraction, the vulnerable path handling fails to keep the hardlink target confined to the intended extraction directory. The operating system resolves the drive-relative path outside the extraction root, allowing the archive operation to overwrite a file elsewhere on disk. The attacker’s end goal depends on the overwritten file: data destruction, configuration tampering, dependency or artifact poisoning, or persistence and code execution when a modified script, configuration, or application file is later used.

How to fix it

Upgrade the Node.js tar package to version 7.5.10 or later wherever it is used directly or transitively. Regenerate dependency lockfiles after upgrading and redeploy applications, CI images, developer tooling containers, and build runners that bundle the affected package. If immediate upgrade is not possible, avoid extracting untrusted tar archives, reject archives containing hardlinks or drive-relative link targets, extract archives inside a disposable sandbox with minimal privileges, and ensure the extraction working directory is isolated from sensitive files. Treat tar extraction as unsafe input handling and enforce allowlisted destination paths after canonical path resolution.

How to confirm the fix worked

Confirm that all deployed applications, build images, package-processing workers, and developer tooling use node-tar 7.5.10 or later. Check package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, SBOMs, container images, and node_modules/tar/package.json for vulnerable versions. Validate that dependency scanners no longer report node-tar versions below 7.5.10. Where feasible, run a controlled regression test using a crafted archive with a drive-relative hardlink target and confirm extraction fails or remains confined to the intended directory. Also verify that upload/import workflows reject or safely sandbox tar archives containing hardlinks.

Typical attack path

1. Identify a service, tool, CI job, package workflow, or user process that extracts attacker-supplied tar archives using node-tar before 7.5.10.
2. Create a tar archive containing a hardlink entry with a drive-relative traversal target such as C:../target.txt.
3. Place archive content so the extracted hardlink causes overwrite of a file outside the intended extraction directory.
4. Deliver the malicious archive through an upload feature, package import, source artifact, dependency package, build input, or social engineering.
5. Wait for the vulnerable extraction routine to process the archive with tar.x().
6. Leverage the overwritten file to corrupt data, alter configuration, poison build output, or gain later execution through a trusted script or application path.

How to detect it

To determine whether this was already exploited, review systems and workflows that extracted untrusted tar archives using node-tar before 7.5.10. Relevant log sources include application upload/import logs, CI/CD job logs, artifact-processing logs, package ingestion logs, endpoint file integrity monitoring, EDR file-write telemetry, and shell/process execution logs around archive extraction. Look for tar archives containing hardlink entries with drive-relative paths, especially strings like C:../ or C:..\. Investigate unexpected file modifications outside temporary extraction directories immediately after archive extraction events, particularly changes to configuration files, scripts, package manifests, build outputs, startup files, or service files. In CI/CD environments, compare build artifacts against source-controlled expectations and review whether any job extracted externally supplied archives before producing deployable artifacts. Because successful exploitation may only appear as a file overwrite, absence of a distinctive process or network indicator does not rule out compromise.

• C:../
• C:..\
• linkpath: C:../
• linkpath: C:..\
• node_modules/tar/package.json
• "tar": "<7.5.10"
• "tar":"<7.5.10"

What your security team should do

• Inventory all direct and transitive uses of the Node.js tar package across applications, CI/CD systems, developer images, package importers, and artifact-processing services.
• Prioritize upgrading node-tar to 7.5.10 or later in systems that extract user-supplied, third-party, or build-supplied tar archives.
• Regenerate and review lockfiles to ensure vulnerable transitive versions are not retained by dependency resolution.
• Add archive inspection controls that reject hardlinks, symlinks, absolute paths, parent-directory traversal, and drive-relative link targets when archives come from untrusted sources.
• Run filesystem integrity checks on systems that processed untrusted tar archives while running vulnerable versions, focusing on configuration, scripts, build artifacts, and application directories adjacent to extraction paths.
• Harden extraction workflows by using low-privilege service accounts, disposable workspaces, containers, and post-extraction canonical path validation.
• Monitor dependency security feeds for node-tar advisories and ensure automated dependency update pipelines cover transitive JavaScript packages.