Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R C H L N 8.2 .0054 43.2 —
AFFECTED Product Versions Fixed node-tar < 7.5.7 – —
TIMELINE Jan 27 Reserved by GitHub_M Jan 28 Published (CNA: GitHub_M) Aug 17 EXPLOIT PUBLISHED — CVE-2026-24842 (isaacs node-tar). Public exploit reference added.
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
| Date | Event | Detail |
|---|---|---|
| January 27, 2026 | Reserved | Reserved by GitHub_M |
| January 28, 2026 | Published | Published (CNA: GitHub_M) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-24842 (isaacs node-tar). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| isaacs | node-tar | — | < 7.5.7 | — |
Authoritative record: CVE-2026-24842 at cve.org
Vendors: isaacs
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-24842 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.