CVE-2026-44705

What it actually does

The flaw allows path traversal in the Node.js tmp package before version 0.2.6 when untrusted input is passed into the prefix, postfix, or dir options used for temporary file or directory creation. By supplying path separators or traversal sequences such as ../, an attacker can cause the application to create temporary files or directories outside the intended temporary location. The created object is written with the privileges of the running Node.js process, which can lead to unauthorized file placement, sensitive path probing, or staging of files in application-controlled locations. The impact depends heavily on how the application uses tmp and whether the attacker can influence filenames, directories, file contents, or subsequent processing of the created file.

Why it matters to the business

Applications using vulnerable versions of tmp may allow external users to influence where files are created on the server. In practical terms, this can undermine assumptions about temporary-file isolation, expose the organization to unauthorized file writes, and create a foothold for further compromise if created files are later processed, served, executed, archived, or trusted by the application. Although EPSS is currently low and there is no known KEV listing, tmp is a common Node.js utility pattern, so exposure may be widespread through direct and transitive dependencies.

How an attack unfolds

An attacker first identifies an application feature that creates temporary files or directories using the tmp package and accepts user-controlled values that are passed into prefix, postfix, or dir. The attacker then submits crafted input containing traversal sequences or path separators so the generated temporary path escapes the expected temporary base directory. If the application does not normalize, reject, or constrain that input, tmp creates the file or directory at an attacker-influenced location using the permissions of the Node.js process. The attacker may then use the misplaced file to interfere with application behavior, plant data where it may later be read or served, overwrite predictable application-adjacent paths if naming and permissions allow, or chain the primitive with other weaknesses such as unsafe file serving, template loading, archive generation, or insecure cleanup routines.

How to fix it

Upgrade the tmp npm package to version 0.2.6 or later wherever it is used, including transitive dependency paths where possible. Regenerate lockfiles after updating and rebuild/redeploy affected applications. If immediate upgrade is not possible, ensure no untrusted input is passed directly into tmp prefix, postfix, or dir options; allow only strict, minimal character sets; reject path separators, absolute paths, URL-encoded traversal, and dot-dot segments; and resolve and verify the final path remains under the intended temporary base directory before use. Prefer server-generated prefixes and directories rather than user-provided values. Run Node.js services with least-privilege filesystem permissions so unexpected file creation cannot affect sensitive paths.

How to confirm the fix worked

Confirm dependency resolution shows tmp version 0.2.6 or later in package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, and deployed node_modules artifacts. Use dependency scanning, npm ls tmp, or equivalent SBOM tooling to identify direct and transitive uses. Review application code for calls to tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or related APIs where prefix, postfix, or dir may be derived from request parameters, headers, filenames, form fields, archive metadata, or other untrusted input. Test representative affected workflows with benign traversal payloads and confirm the application rejects them or still creates files only under the approved temporary directory. Validate at runtime that the Node.js process cannot write to sensitive application, configuration, web root, or system directories.

Typical attack path

1. Find an application endpoint or workflow that creates temporary files or directories.
2. Determine whether user-supplied values influence tmp options such as prefix, postfix, or dir.
3. Submit crafted input containing ../, ..\, absolute-path syntax, or path separators.
4. Cause tmp to create a file or directory outside the intended temporary directory.
5. Use the misplaced file or directory to influence application behavior, expose data, stage content, or support a follow-on exploit chain.

How to detect it

Investigate whether application features that create temporary files received inputs containing traversal patterns, encoded path separators, absolute paths, or suspicious filename values. Useful sources include HTTP access logs, API gateway logs, WAF logs, application logs around upload/export/report/temp-file workflows, Node.js error logs, container stdout/stderr, endpoint file-creation telemetry, EDR events, and filesystem audit logs. Look for temporary files or directories created outside approved temporary locations, especially under application directories, public/static web roots, configuration paths, job-processing directories, or locations later consumed by the application. Correlate suspicious requests with file creation events by timestamp, process user, container/pod, process name, and request identifier. Because exploitation artifacts are application-specific and the vulnerability provides a file-placement primitive rather than a fixed payload, absence of a known indicator does not rule out exploitation.

What your security team should do

• Inventory all Node.js applications and dependency trees for tmp versions earlier than 0.2.6.
• Prioritize internet-facing services, file-upload workflows, document conversion services, export/report generation features, and any service that handles attacker-supplied filenames or paths.
• Upgrade tmp to 0.2.6 or later and redeploy affected applications from clean builds.
• Add input validation that rejects path separators, absolute paths, URL-encoded traversal, and dot-dot segments for all values used in temporary-file naming or placement.
• Review code paths using tmp options prefix, postfix, and dir for user-controlled data flow.
• Harden filesystem permissions for Node.js services so application processes cannot write to unnecessary directories.
• Add tests that assert temporary files and directories are always created under the intended base directory.
• Search logs and filesystem artifacts for evidence of attempted traversal or unexpected file creation outside approved temporary directories.