Log in Start free

Vulnerability · Published Jan 20, 2026 · Assigned by GitHub_M

CVE-2026-23950node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

High 8.8

In plain English

A high-severity cross-site request forgery in node-tar from isaacs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 81.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10sgx-common2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-common2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-libs2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-libs2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-mpa2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-mpa2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pccs2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pccs2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pccs-admin2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pccs-admin2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pckid-tool2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pckid-tool2.26-7.el9ALSA-2026:18868
AlmaLinux:10tdx-qgs2.26-7.el10ALSA-2026:18480
AlmaLinux:9tdx-qgs2.26-7.el9ALSA-2026:18868
Debian:12node-tarno fix listedDEBIAN-CVE-2026-23950
Debian:13node-tar6.2.1+~cs7.0.8-1+deb13u1DEBIAN-CVE-2026-23950
Debian:14node-tar6.2.1+ds1+~cs6.1.13-7DEBIAN-CVE-2026-23950
Rocky Linux:10linux-sgx0:2.26-7.el10RLSA-2026:18480
Rocky Linux:9linux-sgx0:2.26-7.el9RLSA-2026:18868
Ubuntu:22.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-23950
Ubuntu:24.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-23950
Ubuntu:25.10node-tarno fix listedUBUNTU-CVE-2026-23950
Ubuntu:26.04:LTSnode-tarno fix listedUBUNTU-CVE-2026-23950
Ubuntu:26.10node-tarno fix listedUBUNTU-CVE-2026-23950
npmtar7.5.4GHSA-r6q2-hw4h-h46w

Affected products (as reported)

VendorProductVersions
isaacs node-tar < 7.5.4

Weakness: CWE-176, CWE-352, CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

References