Description
tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| raszi | node-tmp | < 0.2.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-tmp | 0.2.2+dfsg+~0.2.3-1.1 | — |
| Debian 13 | node-tmp | 0.2.2+dfsg+~0.2.3-1.1~deb13u1 | — |
| Debian 12 | node-tmp | 0.2.2+dfsg+~0.2.3-1.1~deb12u1 | — |
| Debian 11 | node-tmp | 0.2.1+dfsg-1+deb11u1 | DLA-4268-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-tmp | No fix yet | — |
| Ubuntu 26.04 LTS | node-tmp | No fix yet | — |
| Ubuntu 25.10 | node-tmp | No fix yet | — |
| Ubuntu 24.04 LTS | node-tmp | No fix yet | — |
| Ubuntu 22.04 LTS | node-tmp | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-tmp | No fix yet | — |
| Ubuntu 18.04 LTS | node-tmp | No fix yet | — |
| Ubuntu 16.04 LTS | node-tmp | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-bqplot | 0.12.45-13.1 | openSUSE-SU-2025:15506-1 |
| openSUSE Tumbleweed | python-nbdime | 4.0.2-23.1 | openSUSE-SU-2025:15502-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r10 | — |
| Wolfi rolling | lerna | 8.2.4-r1 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-notifications +4 | 3.4.0-r0 | — |
| Wolfi rolling | prism | 5.14.2-r7 | — |
| Wolfi rolling | py3.10-jupyterlab +3 | 4.6.1-r1 | — |
| Wolfi rolling | saf | 1.5.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | tmp | < 0.2.4 | 0.2.4 | GHSA-52f5-9888-hmc6 |
Advisories 4
- WID-SEC-2026-0778 Dell Secure Connect Gateway Policy Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- openSUSE-SU-2025:15502-1 jupyter-nbdime-7.0.2-23.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15506-1 jupyter-bqplot-jupyterlab-0.5.46-13.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4268-1 node-tmp - security update Debian Security (DSA / DLA) · Mar 9, 2026