Skip to content
OpenAdvisories
High USN-4863-1 1 CVE

node-fstream vulnerability

Published Mar 15, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that fstream incorrectly handled certain crafted
tarballs. An attacker could use this vulnerability to write arbitrary files
to the filesystem.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS node-fstream 0.1.24-1ubuntu0.14.04.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS node-fstream 0.1.24-1ubuntu0.16.04.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2019-13173

    Arbitrary File Overwrite in fstream

    fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted f…

    fstream node-fstream node-fstream Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2019-13173