Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-29786: node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10. CVE-2026-26960: node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs22 | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-debuginfo | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-debugsource | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-devel | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-docs | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-full-i18n | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-libs | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-libs-debuginfo | 1:22.22.1-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-npm | 1:10.9.4-1.22.22.1.1.amzn2023.0.1 |
| Amazon Linux · 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.22.1.1.amzn2023.0.1 |
Vulnerabilities 2
-
High 8.2CVE-2026-29786 Public exploit
node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside …
-
High 7.1
node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary fil…