Description
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-tar | 4.4.4+ds1-2 | — |
| Debian 13 | node-tar | 4.4.4+ds1-2 | — |
| Debian 12 | node-tar | 4.4.4+ds1-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.0-1.el7 | RHSA-2019:1821 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.0.1.el7 | RHSA-2019:1821 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | tar | >= 3.0.0, < 4.4.2 | 4.4.2 | GHSA-j44m-qm6p-hp7m |
| npm | tar | < 2.2.2 | 2.2.2 | GHSA-j44m-qm6p-hp7m |
Advisories 3
- RHSA-2019:1821 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- WID-SEC-2023-2535 Red Hat rh-nodejs8-nodejs: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 3, 2023
References
- https://hackerone.com/reports/344595
- https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8
- https://github.com/npm/node-tar/compare/58a8d43...a5f7779
- RHSA-2019:1821 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-20834
- https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d
- https://github.com/npm/node-tar/commits/v2.2.2