CVE-2026-24842 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2026-24842 Interim 1 1 2026-03-05T00:16:15Z current 2026-03-05T00:16:15Z 2026-03-05T00:16:15Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2026-24842 node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server for SAP applications 16.0 openSUSE Leap 15.6 corepack20 corepack22 nodejs10 nodejs10-devel nodejs10-docs nodejs12 nodejs12-devel nodejs12-docs nodejs14 nodejs14-devel nodejs14-docs nodejs16 nodejs16-devel nodejs16-docs nodejs18 nodejs18-devel nodejs18-docs nodejs20 nodejs20-devel nodejs20-docs nodejs22 nodejs22-devel nodejs22-docs nodejs24 nodejs24-devel nodejs24-docs nodejs8 nodejs8-devel nodejs8-docs npm10 npm12 npm14 npm16 npm18 npm20 npm22 npm24 npm8 nodejs16 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS nodejs16-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS nodejs16-docs as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS npm16 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS nodejs18 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS nodejs18-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS nodejs18-docs as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS npm18 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS nodejs18 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS nodejs18-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS nodejs18-docs as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS npm18 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS nodejs20 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS nodejs20-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS nodejs20-docs as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS npm20 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS nodejs22 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 nodejs22-devel as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 nodejs22-docs as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 npm22 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 nodejs24 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 nodejs24-devel as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 nodejs24-docs as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 npm24 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 nodejs18 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS nodejs18-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS nodejs18-docs as a component of SUSE Linux Enterprise Server 12 SP5-LTSS npm18 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS nodejs18 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security nodejs10 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs10-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs10-docs as a component of SUSE Linux Enterprise Server 15 SP1-LTSS npm10 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs8 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs8-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs8-docs as a component of SUSE Linux Enterprise Server 15 SP1-LTSS npm8 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs10 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs10-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs10-docs as a component of SUSE Linux Enterprise Server 15 SP2-LTSS npm10 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs12 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs12-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs12-docs as a component of SUSE Linux Enterprise Server 15 SP2-LTSS npm12 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs14 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs14-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs14-docs as a component of SUSE Linux Enterprise Server 15 SP2-LTSS npm14 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs8 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs8-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs8-docs as a component of SUSE Linux Enterprise Server 15 SP2-LTSS npm8 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs12 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs12-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs12-docs as a component of SUSE Linux Enterprise Server 15 SP3-LTSS npm12 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs14 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs14-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs14-docs as a component of SUSE Linux Enterprise Server 15 SP3-LTSS npm14 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs16 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs16-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs16-docs as a component of SUSE Linux Enterprise Server 15 SP3-LTSS npm16 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs16 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS nodejs16-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS nodejs16-docs as a component of SUSE Linux Enterprise Server 15 SP4-LTSS npm16 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS nodejs18 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS nodejs18-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS nodejs18-docs as a component of SUSE Linux Enterprise Server 15 SP4-LTSS npm18 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS nodejs18 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS nodejs18-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS nodejs18-docs as a component of SUSE Linux Enterprise Server 15 SP5-LTSS npm18 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS nodejs20 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS nodejs20-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS nodejs20-docs as a component of SUSE Linux Enterprise Server 15 SP5-LTSS npm20 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS nodejs20 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS nodejs20-devel as a component of SUSE Linux Enterprise Server 15 SP6-LTSS nodejs20-docs as a component of SUSE Linux Enterprise Server 15 SP6-LTSS npm20 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS nodejs22 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS nodejs22-devel as a component of SUSE Linux Enterprise Server 15 SP6-LTSS nodejs22-docs as a component of SUSE Linux Enterprise Server 15 SP6-LTSS npm22 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS corepack22 as a component of SUSE Linux Enterprise Server 16.0 nodejs22 as a component of SUSE Linux Enterprise Server 16.0 nodejs22-devel as a component of SUSE Linux Enterprise Server 16.0 nodejs22-docs as a component of SUSE Linux Enterprise Server 16.0 npm22 as a component of SUSE Linux Enterprise Server 16.0 nodejs16 as a component of SUSE Linux Enterprise Server Teradata 15 SP4 nodejs18 as a component of SUSE Linux Enterprise Server Teradata 15 SP4 nodejs16 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 nodejs16-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 nodejs16-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 npm16 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 nodejs18 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 nodejs18-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 nodejs18-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 npm18 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 nodejs18 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 nodejs18-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 nodejs18-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 npm18 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 nodejs20 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 nodejs20-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 nodejs20-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 npm20 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 nodejs20 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 nodejs20-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 nodejs20-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 npm20 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 nodejs22 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 nodejs22-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 nodejs22-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 npm22 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 corepack22 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 nodejs22 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 nodejs22-devel as a component of SUSE Linux Enterprise Server for SAP applications 16.0 nodejs22-docs as a component of SUSE Linux Enterprise Server for SAP applications 16.0 npm22 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 corepack20 as a component of openSUSE Leap 15.6 nodejs20 as a component of openSUSE Leap 15.6 nodejs20-devel as a component of openSUSE Leap 15.6 nodejs20-docs as a component of openSUSE Leap 15.6 npm20 as a component of openSUSE Leap 15.6 corepack22 as a component of openSUSE Leap 15.6 nodejs22 as a component of openSUSE Leap 15.6 nodejs22-devel as a component of openSUSE Leap 15.6 nodejs22-docs as a component of openSUSE Leap 15.6 npm22 as a component of openSUSE Leap 15.6 node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue. CVE-2026-24842 important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N