CVE Details
| CVE ID |
Severity |
Affected Package |
Installed Version |
Fixed Version |
Date Published |
Date of Scan |
| CVE-2026-29786 |
HIGH |
tar |
6.2.1 |
7.5.10 |
2026-03-07T16:15:55.587Z |
2026-03-08T10:18:18.777455977Z |
Affected Docker Images
| Image Name |
SHA |
public.ecr.aws/lambda/nodejs:latest |
public.ecr.aws/lambda/nodejs@sha256:cf6459f182e22a52e2bfd10576477c3c70f05ab404d8695bc16b6480c7d37505 |
public.ecr.aws/lambda/nodejs:24 |
public.ecr.aws/lambda/nodejs@sha256:4f78a2edca6966a4ee0f056562d8510267df8f39c90df00f23d52f0b581cbeeb |
public.ecr.aws/lambda/nodejs:22 |
public.ecr.aws/lambda/nodejs@sha256:cf6459f182e22a52e2bfd10576477c3c70f05ab404d8695bc16b6480c7d37505 |
public.ecr.aws/lambda/nodejs:20 |
public.ecr.aws/lambda/nodejs@sha256:5643651ce243fcd5b6209cd5ac348cb2e66a7a9eb8f050c470ad4d19e993c5e4 |
Description
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.
Remediation Steps
- Update the affected package
tar from version 6.2.1 to 7.5.10.
About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit Lambda Watchdog.
- This issue was created automatically by Lambda Watchdog.
