CVE-2026-49982

What it actually does

In raszi tmp 0.2.6, _assertPath only rejects string values containing '..'. Non-string prefix, postfix, or template values (arrays, buffers, or objects) skip that guard; after join/coercion in _generateTmpName and path.join(tmpDir, opts.dir, name), the final path can escape the configured temporary directory. The process then creates a file or directory at that location with the Node.js host privileges. Confidentiality is not directly affected; integrity impact is high (create/overwrite on any path the process can write) and availability impact is low.

Why it matters to the business

Apps that pass request bodies or query fields into tmp can have files or directories created outside the temp folder, which may overwrite data, plant files in writable locations, or disrupt operations. The issue is not in CISA KEV, is not tied to ransomware, and has no public exploit maturity; EPSS is low at 0.006 (up about 21% over 30 days), so widespread exploitation is not indicated. Residual risk remains material for internet-facing Node.js services because no authentication or user interaction is required and integrity impact is high. Unpatched 0.2.6 deployments 111 days after publication should be treated as overdue for a dependency upgrade.

How an attack unfolds

An unauthenticated attacker who can influence options passed into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync sends prefix, postfix, or template as a non-string type (for example a JSON array/object or a bracket-array query field) instead of a plain string. The string-only '..' check does not run. Internal name generation stringifies or joins the value so parent-directory segments appear in the name; path.join then resolves a location outside tmpdir, and the library creates the file or directory there as the application user. No named threat actors or campaigns are associated with this CVE.

How to fix it

Upgrade raszi tmp from 0.2.6 to 0.2.7 or later, which fixes the _assertPath type handling. Refresh lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) so no transitive pin remains on 0.2.6, then rebuild and redeploy. Until upgraded, do not pass request JSON or query data into tmp options; coerce prefix, postfix, template, and dir to strings and reject separator or parent-directory segments. Run the process with least privilege and a dedicated tmpdir so a path escape cannot write sensitive locations.

How to confirm the fix worked

Run npm ls tmp (or inspect lockfiles) and confirm every resolution is 0.2.7 or newer. Search code for tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, and tmp.tmpNameSync where options come from bodies or query strings. After upgrade, confirm created paths stay under os.tmpdir() or the configured tmpdir and that non-string option types are rejected or coerced. Dependency scanners should report tmp 0.2.6 as vulnerable and clear after the bump.

Typical attack path

1. Find a Node.js app that forwards untrusted request fields into raszi tmp APIs without coercing prefix, postfix, template, or dir to safe strings.
2. Send those fields as non-string types so the string-only path guard is skipped.
3. Cause generated names, after join/coercion, to include parent-directory segments.
4. Invoke a tmp create or name API so path.join resolves outside the intended temporary directory.
5. Obtain a file or directory on a writable path under the host process identity.

How to detect it

Review HTTP access logs and application logs around tmp.file/tmp.dir usage for query strings or JSON bodies that supply prefix, postfix, or template as arrays or objects rather than strings. On hosts running Node.js with tmp 0.2.6, look for file or directory creation outside the process tmpdir (os.tmpdir or TMPDIR) at times that correlate with those requests, including names that look like tmp output but contain parent-directory segments after join. Check audit or EDR file-create events for the node process writing unexpectedly outside temp. Package and container inventories showing tmp@0.2.6 indicate exposure, not proven compromise. No named actor tooling or ransomware artifacts are documented for this CVE.

• prefix[]=
• postfix[]=
• template[]=
• "prefix":[
• "postfix":[
• "template":[
• tmp@0.2.6

What your security team should do

• Upgrade all raszi tmp 0.2.6 resolutions to 0.2.7 or later and ship rebuilt artifacts.
• Inventory services that pass request-derived prefix, postfix, template, or dir into tmp APIs and add type and path validation.
• Hunt access logs and app logs for array-typed tmp option fields and for file creates outside the process tmpdir.
• Constrain the Node.js process user and filesystem write paths so a temp-path escape cannot modify application or system locations.
• Track EPSS and public exploit chatter; treat this as a standard high-integrity dependency fix, not an active KEV emergency.