Junglewise Threat Intelligence

CVE-2026-23950: node-tar race condition via Unicode path collision in path-reservations

CVE-2026-23950 · Severity: high · CVSS 8.8 · Published 2026-01-20

Technologies: Node-Tar Tar, Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Executive brief

A security vulnerability exists in node-tar, a widely used library for handling compressed archive files in Node.js applications. On certain systems like macOS, the library fails to correctly identify when two different filenames actually point to the same file due to how it handles special Unicode characters. An attacker could use a specially crafted archive to trick the system into overwriting sensitive files or creating malicious links, potentially leading to unauthorized data modification or system compromise.

Technical details

A race condition exists in node-tar's 'path-reservations' system due to improper handling of Unicode normalization. On filesystems like macOS APFS, different Unicode representations (e.g., 'ß' and 'ss') can resolve to the same inode, but node-tar's internal locking mechanism treats them as distinct paths when using NFD normalization. This allows an attacker to provide a malicious tar archive with colliding paths that bypass concurrency safeguards. By processing these entries in parallel, an attacker can achieve symlink poisoning or arbitrary file overwrites. The vulnerability is addressed in version 7.5.4 by implementing more robust normalization (NFKD) and case-folding before path reservation.

Affected products

  • node-tar tar <= 7.5.3
  • Red Hat Enterprise Linux AppStream 9, 10.2
  • Red Hat OpenShift Dev Spaces 3.27

Timeline

  • 2026-01-19: advisory: GitHub Security Advisory published
  • 2026-01-20: disclosed: NVD publication date
  • 2026-05-19: patched: Red Hat security updates released

References

Related threats