# CVE-2018-20834: npm tar arbitrary file overwrite via hardlink

Source: https://junglewise.ai/threats/cve-2018-20834-npm-tar-arbitrary-file-overwrite-via-hardlink  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-05-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-20834 · Severity: low · CVSS 3 · Published 2019-05-01

The tar library used by npm for extracting compressed archives contains a flaw that allows an attacker to overwrite arbitrary system files. When extracting a specially crafted tarball containing hardlinks and matching files, the library will replace critical system files with attacker-controlled content, potentially enabling code execution or system compromise.

Technologies: [tar (npm)](https://junglewise.ai/threats/technologies/npm-tar). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-20834 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-20834 being exploited in the wild.

**How severe is CVE-2018-20834?** Low severity, with a CVSS score of 3, published 1 May 2019.

**Which products and versions are affected?** tar (npm) SEMVER:introduced=3.0.0,fixed=4.4.2.

**Is there a fix for CVE-2018-20834?** Yes. tar (npm): upgrade to 4.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-20834 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-20834?** Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tar (npm): upgrade to 4.4.2 or later

  ```sh
  npm install tar@4.4.2
  ```


## Technical details

The vulnerability exists in npm's tar package (versions below 4.4.2 for 4.x and 2.2.2 for 2.x) and is rooted in improper handling of hardlinks during tarball extraction. When extracting a tarball, if it contains a hardlink pointing to a file that already exists on the system, and the archive also contains content matching that hardlink target, the extraction process overwrites the existing file with the archive contents without proper validation. This is a path traversal variant (CWE-59) exploitable via malicious tarball contents, requiring only that a user extract an untrusted archive. No authentication or special privileges are required on the part of the attacker. The vulnerability was patched by upgrading the underlying fstream dependency and removing flawed hardlink override logic.

## Affected products

- npm tar below 4.4.2 for 4.x; below 2.2.2 for 2.x

## Identifiers

- CVE-2018-20834
- GHSA-j44m-qm6p-hp7m

## Timeline

- 2019-05-01: disclosed
- 2019-05-14: patched

## References

- [https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d](https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d)

## Related threats

- [npm tar stack overflow in mapHas filter with long paths](https://junglewise.ai/threats/cve-2026-73566-npm-tar-stack-overflow-in-maphas-filter-with-long-paths)
- [node-tar denial of service via NUL byte in PAX records](https://junglewise.ai/threats/cve-2026-59875-node-tar-denial-of-service-via-nul-byte-in-pax-records)
- [isaacs node-tar infinite loop in tar.replace](https://junglewise.ai/threats/cve-2026-59874-isaacs-node-tar-infinite-loop-in-tar-replace)
- [isaacs node-tar Denial of Service via Gzip Bomb](https://junglewise.ai/threats/cve-2026-59873-isaacs-node-tar-denial-of-service-via-gzip-bomb)
- [isaacs node-tar denial of service via PAX numeric path type confusion](https://junglewise.ai/threats/cve-2026-59871-isaacs-node-tar-denial-of-service-via-pax-numeric-path-type)