The node-tar package for Node.js versions before 7.5.10 contains a path traversal vulnerability where a specially crafted tar archive can cause the creation of a hardlink pointing outside the extraction directory. This is achieved by using a drive-relative link target such as 'C:../target.txt', enabling file overwrite outside the current working directory during normal tar extraction. This vulnerability is tracked as CVE-2026-29786 and has a CVSS 4.0 score of 8.2 (high severity). The issue was patched in node-tar version 7.5.10. Red Hat has published an advisory confirming the vulnerability and its remediation.

Successful exploitation allows an attacker to overwrite arbitrary files outside the extraction directory by leveraging a path traversal via hardlink creation. This can lead to unauthorized file modification, potentially compromising system integrity or security depending on the files overwritten.

Upgrade node-tar to version 7.5.10 or later, where this vulnerability has been patched. No additional mitigation is required if the upgrade is applied. Patch status is confirmed by the vendor advisory from Red Hat.