Description
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | node-fstream | 1.0.12-1 | — |
| Debian 12 | node-fstream | 1.0.12-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-fstream | 1.0.10-1ubuntu0.18.04.1 | USN-4123-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | node-fstream | 0.1.24-1ubuntu0.16.04.1~esm1 | USN-4863-1 |
| Ubuntu Pro 14.04 LTS | node-fstream | 0.1.24-1ubuntu0.14.04.1~esm1 | USN-4863-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nodejs10 | 10.16.0-1.9.1 | SUSE-SU-2019:2081-1 |
| SLES 15 SP1 | nodejs8 | 8.15.1-3.17.1 | SUSE-SU-2019:2055-1 |
| SLES 15 | nodejs10 | 10.16.0-1.9.1 | SUSE-SU-2019:2081-1 |
| SLES 15 | nodejs8 | 8.15.1-3.17.1 | SUSE-SU-2019:2055-1 |
| SLES 12 | nodejs10 | 10.16.0-1.9.1 | SUSE-SU-2019:2099-1 |
| SLES 12 | nodejs12 | 12.13.0-1.3.1 | SUSE-SU-2020:0059-1 |
| SLES 12 | nodejs4 | 4.9.1-15.23.1 | SUSE-SU-2019:2078-1 |
| SLES 12 | nodejs6 | 6.17.0-11.27.1 | SUSE-SU-2019:2181-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | nodejs6 | 6.17.0-11.27.1 | SUSE-SU-2019:2181-1 |
| SUSE OpenStack Cloud Crowbar 8 | nodejs6 | 6.17.0-11.27.1 | SUSE-SU-2019:2181-1 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.17.0-11.27.1 | SUSE-SU-2019:2181-1 |
| SUSE Enterprise Storage 4 | nodejs4 | 4.9.1-15.23.1 | SUSE-SU-2019:2078-1 |
| SUSE Enterprise Storage 4 | nodejs6 | 6.17.0-11.27.1 | SUSE-SU-2019:2181-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | nodejs10 | 10.16.0-lp151.2.3.1 | openSUSE-SU-2019:1846-1 |
| openSUSE Leap 15.1 | nodejs8 | 8.15.1-lp151.2.3.1 | openSUSE-SU-2019:1907-1 |
| openSUSE Leap 15.0 | nodejs8 | 8.15.1-lp151.2.3.1 | openSUSE-SU-2019:1907-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fstream | < 1.0.12 | 1.0.12 | GHSA-xf7w-r453-m56c |
Advisories 11
- USN-4863-1 node-fstream vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-4123-1 npm/fstream vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2019:1846-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2081-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2078-1 Security update for nodejs4 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2099-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1907-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0059-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2181-1 Security update for nodejs6 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2055-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://www.npmjs.com/advisories/886
- https://github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22
- openSUSE-SU-2019:1846 vendor-advisory
- openSUSE-SU-2019:1907 vendor-advisory
- USN-4123-1 vendor-advisory