GHSA-r6q2-hw4h-h46w
High · 8.8CVSS
8.8
EPSS
—
Published
Jan 21, 2026
CISA due date
—
The record
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tar | 0 | 7.5.4 |
| Chainguard | actions-runner | 0 | 2.331.0-r1 |
| Chainguard | code-server | 0 | 4.106.3-r4 |
| Chainguard | graalvm-25-ce-nodejs | 0 | 25.0.2-r1 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r8 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r8 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r8 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r8 |
| Chainguard | kibana-8.19 | 0 | 8.19.10-r2 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.10-r2 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r8 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r8 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r8 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r3 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r3 |
| Chainguard | kibana-9.2 | 0 | 9.2.3-r5 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.3-r5 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Chainguard | lerna | 0 | 9.0.3-r1 |
| Chainguard | node-gyp | 0 | 12.2.0-r0 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r0 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r0 |
| Chainguard | prism | 0 | 5.14.3-r5 |
| Chainguard | pulumi-language-nodejs | 0 | 3.215.0-r1 |
| Chainguard | redisinsight | 0 | 3.0.2-r1 |
| Chainguard | renovate | 0 | 43.2.4-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r6 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r2 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r3 |
| Chainguard | vitess-22 | 0 | 22.0.3-r0 |
| Chainguard | vitess-23 | 0 | 23.0.1-r0 |
| Wolfi | code-server | 0 | 4.106.3-r4 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r10 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Wolfi | lerna | 0 | 9.0.3-r1 |
| Wolfi | node-gyp | 0 | 12.2.0-r0 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r15 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Wolfi | prism | 0 | 5.14.3-r5 |
| Wolfi | pulumi-language-nodejs | 0 | 3.215.0-r1 |
| Wolfi | renovate | 0 | 43.2.4-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r6 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r2 |
| Wolfi | vitess-22 | 0 | 22.0.3-r0 |
| Wolfi | vitess-23 | 0 | 23.0.1-r0 |
Related vulnerabilities
- CVE-2026-23950 node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and… Same vulnerability
- CVE-2026-53655 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers… Also affects tar
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects tar
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-26960 node-tar is a full-featured Tar for Node.js. Also affects tar