--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:node-tar
User: [email protected]
Usertags: pu
[ Reason ]
node-tar is vulnerable to 6 CVE. The more important is the possibility
to points to a file outside the extraction root, enabling arbitrary file
read and write as the extracting user.
- CVE-2026-23745: sanitize absolute linkpaths properly
- CVE-2026-23950: normalize out unicode ligatures
- CVE-2026-29786: parse root off paths before sanitizing parts
- CVE-2026-26960: do not write linkpaths through symlinks
(Closes: #1129378)
- CVE-2026-24842: properly sanitize hard links containing '..'
- CVE-2026-31802: prevent escaping symlinks with drive-relative paths
The 2 lasts are regressions introduced by CVE-2026-23745 patch
[ Impact ]
Medium security issues
[ Tests ]
Test pass
[ Risks ]
Medium risk, test pass and test coverage looks good
[ Checklist ]
[X] *all* changes are documented in the d/changelog
[X] I reviewed all changes and I approve them
[X] attach debdiff against the package in (old)stable
[X] the issue is verified as fixed in unstable
Best regards,
Xavier
diff --git a/debian/changelog b/debian/changelog
index 32e118b..968ebc5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+node-tar (6.2.1+~cs7.0.8-1+deb13u1) trixie; urgency=medium
+
+ * Team upload
+ * Add patches for 6 CVEs: CVE-2026-23745, CVE-2026-23950, CVE-2026-24842,
+ CVE-2026-26960, CVE-2026-29786, CVE-2026-31802 (Closes: #1129378)
+
+ -- Xavier Guimard <[email protected]> Tue, 24 Mar 2026 12:34:05 +0100
+
node-tar (6.2.1+~cs7.0.8-1) unstable; urgency=medium
* New upstream version
diff --git a/debian/patches/CVE-2026-23745.patch
b/debian/patches/CVE-2026-23745.patch
new file mode 100644
index 0000000..146fb83
--- /dev/null
+++ b/debian/patches/CVE-2026-23745.patch
@@ -0,0 +1,145 @@
+Description: sanitize absolute linkpaths properly
+Author: isaacs <[email protected]>
+Origin: upstream, https://github.com/isaacs/node-tar/commit/340eb285
+Bug: https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97
+Forwarded: not-needed
+Applied-Upstream: 7.5.3, commit:340eb285
+Reviewed-By: Xavier Guimard <[email protected]>
+Last-Update: 2026-01-17
+
+--- a/lib/unpack.js
++++ b/lib/unpack.js
+@@ -32,6 +32,7 @@
+ const HARDLINK = Symbol('hardlink')
+ const UNSUPPORTED = Symbol('unsupported')
+ const CHECKPATH = Symbol('checkPath')
++const STRIPABSOLUTEPATH = Symbol('stripAbsolutePath')
+ const MKDIR = Symbol('mkdir')
+ const ONERROR = Symbol('onError')
+ const PENDING = Symbol('pending')
+@@ -244,6 +245,43 @@
+ }
+ }
+
++ // return false if we need to skip this file
++ // return true if the field was successfully sanitized
++ [STRIPABSOLUTEPATH]( entry, field ) {
++ const path = entry[field]
++ if (!path || this.preservePaths) return true
++
++ const parts = path.split('/')
++ if (
++ parts.includes('..') ||
++ /* c8 ignore next */
++ (isWindows && /^[a-z]:\.\.$/i.test(parts[0] ?? ''))
++ ) {
++ this.warn('TAR_ENTRY_ERROR', `${field} contains '..'`, {
++ entry,
++ [field]: path,
++ })
++ // not ok!
++ return false
++ }
++
++ // strip off the root
++ const [root, stripped] = stripAbsolutePath(path)
++ if (root) {
++ // ok, but triggers warning about stripping root
++ entry[field] = String(stripped)
++ this.warn(
++ 'TAR_ENTRY_INFO',
++ `stripping ${root} from absolute ${field}`,
++ {
++ entry,
++ [field]: path,
++ },
++ )
++ }
++ return true
++ }
++
+ [CHECKPATH] (entry) {
+ const p = normPath(entry.path)
+ const parts = p.split('/')
+@@ -274,24 +312,11 @@
+ return false
+ }
+
+- if (!this.preservePaths) {
+- if (parts.includes('..') || isWindows &&
/^[a-z]:\.\.$/i.test(parts[0])) {
+- this.warn('TAR_ENTRY_ERROR', `path contains '..'`, {
+- entry,
+- path: p,
+- })
+- return false
+- }
+-
+- // strip off the root
+- const [root, stripped] = stripAbsolutePath(p)
+- if (root) {
+- entry.path = stripped
+- this.warn('TAR_ENTRY_INFO', `stripping ${root} from absolute path`, {
+- entry,
+- path: p,
+- })
+- }
++ if (
++ !this[STRIPABSOLUTEPATH](entry, 'path') ||
++ !this[STRIPABSOLUTEPATH](entry, 'linkpath')
++ ) {
++ return false
+ }
+
+ if (path.isAbsolute(entry.path)) {
+--- /dev/null
++++ b/test/ghsa-8qq5-rm4j-mr97.js
+@@ -0,0 +1,49 @@
++const { readFileSync, readlinkSync, writeFileSync } = require('fs')
++const { resolve } = require('path')
++const t = require('tap')
++const Header = require('../lib/header.js')
++const x = require('../lib/extract.js')
++
++const targetSym = '/some/absolute/path'
++
++const getExploitTar = () => {
++ const exploitTar = Buffer.alloc(512 + 512 + 1024)
++
++ new Header({
++ path: 'exploit_hard',
++ type: 'Link',
++ size: 0,
++ linkpath: resolve(t.testdirName, 'secret.txt'),
++ }).encode(exploitTar, 0)
++
++ new Header({
++ path: 'exploit_sym',
++ type: 'SymbolicLink',
++ size: 0,
++ linkpath: targetSym,
++ }).encode(exploitTar, 512)
++
++ return exploitTar
++}
++
++const dir = t.testdir({
++ 'secret.txt': 'ORIGINAL DATA',
++ 'exploit.tar': getExploitTar(),
++ out_repro: {},
++})
++
++const out = resolve(dir, 'out_repro')
++const tarFile = resolve(dir, 'exploit.tar')
++
++t.test('verify that linkpaths get sanitized properly', async t => {
++ await x({
++ cwd: out,
++ file: tarFile,
++ preservePaths: false,
++ })
++
++ writeFileSync(resolve(out, 'exploit_hard'), 'OVERWRITTEN')
++ t.equal(readFileSync(resolve(dir, 'secret.txt'), 'utf8'), 'ORIGINAL DATA')
++
++ t.not(readlinkSync(resolve(out, 'exploit_sym')), targetSym)
++})
diff --git a/debian/patches/CVE-2026-23950.patch
b/debian/patches/CVE-2026-23950.patch
new file mode 100644
index 0000000..ab164b4
--- /dev/null
+++ b/debian/patches/CVE-2026-23950.patch
@@ -0,0 +1,132 @@
+Description: normalize out unicode ligatures
+Author: Yadd <[email protected]>
+Origin: upstream, https://github.com/isaacs/node-tar/commit/3b1abfae
+Bug: https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w
+Forwarded: not-needed
+Applied-Upstream: 7.5.4, commit:3b1abfae
+Reviewed-By: Xavier Guimard <[email protected]>
+Last-Update: 2026-01-22
+
+--- a/lib/normalize-unicode.js
++++ b/lib/normalize-unicode.js
+@@ -6,7 +6,11 @@
+ const { hasOwnProperty } = Object.prototype
+ module.exports = s => {
+ if (!hasOwnProperty.call(normalizeCache, s)) {
+- normalizeCache[s] = s.normalize('NFD')
++ // shake out identical accents and ligatures
++ normalizeCache[s] = s
++ .normalize('NFD')
++ .toLocaleLowerCase('en')
++ .toLocaleUpperCase('en')
+ }
+ return normalizeCache[s]
+ }
+--- a/lib/path-reservations.js
++++ b/lib/path-reservations.js
+@@ -123,7 +123,7 @@
+ // effectively removing all parallelization on windows.
+ paths = isWindows ? ['win32 parallelization disabled'] : paths.map(p => {
+ // don't need normPath, because we skip this entirely for windows
+- return stripSlashes(join(normalize(p))).toLowerCase()
++ return stripSlashes(join(normalize(p)))
+ })
+
+ const dirs = new Set(
+--- a/tap-snapshots/test/normalize-unicode.js.test.cjs
++++ b/tap-snapshots/test/normalize-unicode.js.test.cjs
+@@ -6,25 +6,25 @@
+ */
+ 'use strict'
+ exports[`test/normalize-unicode.js TAP normalize with strip slashes
"1/4foo.txt" > normalized 1`] = `
+-1/4foo.txt
++1/4FOO.TXT
+ `
+
+ exports[`test/normalize-unicode.js TAP normalize with strip slashes
"\\\\a\\\\b\\\\c\\\\d\\\\" > normalized 1`] = `
+-/a/b/c/d
++/A/B/C/D
+ `
+
+ exports[`test/normalize-unicode.js TAP normalize with strip slashes
"¼foo.txt" > normalized 1`] = `
+-¼foo.txt
++¼FOO.TXT
+ `
+
+ exports[`test/normalize-unicode.js TAP normalize with strip slashes
"﹨aaaa﹨dddd﹨" > normalized 1`] = `
+-﹨aaaa﹨dddd﹨
++﹨AAAA﹨DDDD﹨
+ `
+
+ exports[`test/normalize-unicode.js TAP normalize with strip slashes
"＼bbb＼eee＼" > normalized 1`] = `
+-＼bbb＼eee＼
++＼BBB＼EEE＼
+ `
+
+ exports[`test/normalize-unicode.js TAP normalize with strip slashes
"＼＼＼＼＼eee＼＼＼＼＼＼" > normalized 1`] = `
+-＼＼＼＼＼eee＼＼＼＼＼＼
++＼＼＼＼＼EEE＼＼＼＼＼＼
+ `
+--- /dev/null
++++ b/test/ghsa-r6q2-hw4h-h46w.js
+@@ -0,0 +1,49 @@
++const t = require('tap')
++const normalizeUnicode = require('../lib/normalize-unicode.js')
++const Header = require('../lib/header.js')
++const { resolve } = require('path')
++const { lstatSync, readFileSync, statSync } = require('fs')
++const extract = require('../lib/extract.js')
++
++// these characters are problems on macOS's APFS
++const chars = {
++ ['ff'.normalize('NFC')]: 'FF',
++ ['fi'.normalize('NFC')]: 'FI',
++ ['fl'.normalize('NFC')]: 'FL',
++ ['ffi'.normalize('NFC')]: 'FFI',
++ ['ffl'.normalize('NFC')]: 'FFL',
++ ['ſt'.normalize('NFC')]: 'ST',
++ ['st'.normalize('NFC')]: 'ST',
++ ['ẛ'.normalize('NFC')]: 'Ṡ',
++ ['ß'.normalize('NFC')]: 'SS',
++ ['ẞ'.normalize('NFC')]: 'SS',
++ ['ſ'.normalize('NFC')]: 'S',
++}
++
++for (const [c, n] of Object.entries(chars)) {
++ t.test(`${c} => ${n}`, async t => {
++ t.equal(normalizeUnicode(c), n)
++
++ t.test('link then file', async t => {
++ const tarball = Buffer.alloc(2048)
++ new Header({
++ path: c,
++ type: 'SymbolicLink',
++ linkpath: './target',
++ }).encode(tarball, 0)
++ new Header({
++ path: n,
++ type: 'File',
++ size: 1,
++ }).encode(tarball, 512)
++ tarball[1024] = 'x'.charCodeAt(0)
++
++ const cwd = t.testdir({ tarball })
++
++ await extract({ cwd, file: resolve(cwd, 'tarball') })
++
++ t.throws(() => statSync(resolve(cwd, 'target')))
++ t.equal(readFileSync(resolve(cwd, n), 'utf8'), 'x')
++ })
++ })
++}
+--- a/test/normalize-unicode.js
++++ b/test/normalize-unicode.js
+@@ -12,7 +12,7 @@
+
+ t.equal(normalize(cafe1), normalize(cafe2), 'matching unicodes')
+ t.equal(normalize(cafe1), normalize(cafe2), 'cached')
+-t.equal(normalize('foo'), 'foo', 'non-unicode string')
++t.equal(normalize('foo'), 'FOO', 'non-unicode string')
+
+ t.test('normalize with strip slashes', t => {
+ const paths = [
diff --git a/debian/patches/CVE-2026-24842.patch
b/debian/patches/CVE-2026-24842.patch
new file mode 100644
index 0000000..f7f547b
--- /dev/null
+++ b/debian/patches/CVE-2026-24842.patch
@@ -0,0 +1,28 @@
+Description: properly sanitize hard links containing ..
+ The issue is that *hard* links are resolved relative to the unpack cwd,
+ so if they have `..`, they cannot possibly be valid. The loosening of
+ the '..' restriction for symbolic links should have been limited by type.
+Author: isaacs <[email protected]>
+Origin: upstream, https://github.com/isaacs/node-tar/commit/f4a7aa9b
+Bug: https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v
+Forwarded: not-needed
+Applied-Upstream: 7.5.7, commit:f4a7aa9b
+Last-Update: 2026-03-24
+
+--- a/lib/unpack.js
++++ b/lib/unpack.js
+@@ -251,11 +251,13 @@
+ // return true if the field was successfully sanitized
+ [STRIPABSOLUTEPATH]( entry, field ) {
+ const path = entry[field]
++ const { type } = entry
+ if (!path || this.preservePaths) return true
+
+ const parts = path.split('/')
+ if (
+- parts.includes('..') ||
++ (parts.includes('..') &&
++ (field === 'path' || type === 'Link')) ||
+ /* c8 ignore next */
+ (isWindows && /^[a-z]:\.\.$/i.test(parts[0] ?? ''))
+ ) {
diff --git a/debian/patches/CVE-2026-26960.patch
b/debian/patches/CVE-2026-26960.patch
new file mode 100644
index 0000000..de59193
--- /dev/null
+++ b/debian/patches/CVE-2026-26960.patch
@@ -0,0 +1,139 @@
+From: isaacs <[email protected]>
+Date: Thu, 12 Feb 2026 20:50:19 -0800
+Subject: [PATCH] <short summary of the patch>
+Origin: upstream, https://github.com/isaacs/node-tar/commit/d18e4e1f
+Bug: https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
+Forwarded: not-needed
+Applied-Upstream: 7.5.7, commit:d18e4e1f
+Reviewed-By: Xavier Guimard <[email protected]>
+
+--- /dev/null
++++ b/lib/process-umask.js
+@@ -0,0 +1,4 @@
++// separate file so I stop getting nagged in vim about deprecated API
++module.exports = {
++ umask: () => process.umask()
++};
+--- a/lib/unpack.js
++++ b/lib/unpack.js
+@@ -18,6 +18,7 @@
+ const normPath = require('./normalize-windows-path.js')
+ const stripSlash = require('./strip-trailing-slashes.js')
+ const normalize = require('./normalize-unicode.js')
++const { umask } = require('./process-umask.js')
+
+ const ONENTRY = Symbol('onEntry')
+ const CHECKFS = Symbol('checkFs')
+@@ -30,6 +31,7 @@
+ const LINK = Symbol('link')
+ const SYMLINK = Symbol('symlink')
+ const HARDLINK = Symbol('hardlink')
++const ENSURE_NO_SYMLINK = Symbol('ensureNoSymlink')
+ const UNSUPPORTED = Symbol('unsupported')
+ const CHECKPATH = Symbol('checkPath')
+ const STRIPABSOLUTEPATH = Symbol('stripAbsolutePath')
+@@ -217,7 +219,7 @@
+ this.cwd = normPath(path.resolve(opt.cwd || process.cwd()))
+ this.strip = +opt.strip || 0
+ // if we're not chmodding, then we don't need the process umask
+- this.processUmask = opt.noChmod ? 0 : process.umask()
++ this.processUmask = opt.noChmod ? 0 : umask()
+ this.umask = typeof opt.umask === 'number' ? opt.umask : this.processUmask
+
+ // default mode for dirs created as parents
+@@ -565,12 +567,64 @@
+ }
+
+ [SYMLINK] (entry, done) {
+- this[LINK](entry, entry.linkpath, 'symlink', done)
++ const parts = normPath(
++ path.relative(
++ this.cwd,
++ path.resolve(
++ path.dirname(String(entry.absolute)),
++ String(entry.linkpath),
++ ),
++ ),
++ ).split('/')
++ this[ENSURE_NO_SYMLINK](
++ entry,
++ this.cwd,
++ parts,
++ () =>
++ this[LINK](entry, String(entry.linkpath), 'symlink', done),
++ er => {
++ this[ONERROR](er, entry)
++ done()
++ },
++ )
+ }
+
+ [HARDLINK] (entry, done) {
+ const linkpath = normPath(path.resolve(this.cwd, entry.linkpath))
+- this[LINK](entry, linkpath, 'link', done)
++ const parts = normPath(String(entry.linkpath)).split(
++ '/',
++ )
++ this[ENSURE_NO_SYMLINK](
++ entry,
++ this.cwd,
++ parts,
++ () => this[LINK](entry, linkpath, 'link', done),
++ er => {
++ this[ONERROR](er, entry)
++ done()
++ },
++ )
++ }
++
++ [ENSURE_NO_SYMLINK](
++ entry,
++ cwd,
++ parts,
++ done,
++ onError,
++ ) {
++ const p = parts.shift()
++ if (this.preservePaths || p === undefined) return done()
++ const t = path.resolve(cwd, p)
++ fs.lstat(t, (er, st) => {
++ if (er) return done()
++ if (st?.isSymbolicLink()) {
++ return onError(
++ new SymlinkError(t, path.resolve(t, parts.join('/'))),
++ )
++ }
++ this[ENSURE_NO_SYMLINK](entry, t, parts, done, onError)
++ })
+ }
+
+ [PEND] () {
+@@ -935,6 +989,28 @@
+ }
+ }
+
++ [ENSURE_NO_SYMLINK](
++ _entry,
++ cwd,
++ parts,
++ done,
++ onError,
++ ) {
++ if (this.preservePaths || !parts.length) return done()
++ let t = cwd
++ for (const p of parts) {
++ t = path.resolve(t, p)
++ const [er, st] = callSync(() => fs.lstatSync(t))
++ if (er) return done()
++ if (st.isSymbolicLink()) {
++ return onError(
++ new SymlinkError(t, path.resolve(cwd, parts.join('/'))),
++ )
++ }
++ }
++ done()
++ }
++
+ [LINK] (entry, linkpath, link, done) {
+ try {
+ fs[link + 'Sync'](linkpath, entry.absolute)
diff --git a/debian/patches/CVE-2026-29786.patch
b/debian/patches/CVE-2026-29786.patch
new file mode 100644
index 0000000..c261d51
--- /dev/null
+++ b/debian/patches/CVE-2026-29786.patch
@@ -0,0 +1,22 @@
+From: isaacs <[email protected]>
+Date: Wed, 4 Mar 2026 11:41:10 -0800
+Subject: [PATCH] parse root off paths before sanitizing .. parts
+Origin: upstream, https://github.com/isaacs/node-tar/commit/7bc755dd
+Bug: https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96
+Forwarded: not-needed
+Applied-Upstream: 7.5.10, commit:7bc755dd
+Reviewed-By: Xavier Guimard <[email protected]>
+
+--- a/lib/unpack.js
++++ b/lib/unpack.js
+@@ -284,7 +284,9 @@
+
+ [CHECKPATH] (entry) {
+ const p = normPath(entry.path)
+- const parts = p.split('/')
++ // strip off the root
++ const [root, stripped] = stripAbsolutePath(p)
++ const parts = stripped.replace(/\\/g, '/').split('/')
+
+ if (this.strip) {
+ if (parts.length < this.strip) {
diff --git a/debian/patches/CVE-2026-31802.patch
b/debian/patches/CVE-2026-31802.patch
new file mode 100644
index 0000000..d9aa7dc
--- /dev/null
+++ b/debian/patches/CVE-2026-31802.patch
@@ -0,0 +1,33 @@
+Description: prevent escaping symlinks with drive-relative paths
+ After stripping the drive letter root from paths like c:../../../foo,
+ re-check for '..' to prevent path traversal via drive-relative linkpaths.
+Author: isaacs <[email protected]>
+Origin: upstream, https://github.com/isaacs/node-tar/commit/f48b5fa3
+Bug: https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256
+Forwarded: not-needed
+Applied-Upstream: 7.5.11, commit:f48b5fa3
+Last-Update: 2026-03-24
+
+--- a/lib/unpack.js
++++ b/lib/unpack.js
+@@ -272,6 +272,20 @@
+ // strip off the root
+ const [root, stripped] = stripAbsolutePath(path)
+ if (root) {
++ // After stripping root, re-check for '..' in the stripped path
++ // This catches drive-relative paths like c:../../../foo where
++ // the initial check missed '..' because it was part of 'c:..'
++ const strippedParts = String(stripped).replace(/\\/g, '/').split('/')
++ if (
++ strippedParts.includes('..') &&
++ (field === 'path' || entry.type === 'Link')
++ ) {
++ this.warn('TAR_ENTRY_ERROR', `linkpath escapes extraction directory`,
{
++ entry,
++ [field]: path,
++ })
++ return false
++ }
+ // ok, but triggers warning about stripping root
+ entry[field] = String(stripped)
+ this.warn(
diff --git a/debian/patches/series b/debian/patches/series
index b52771a..2eda2d6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,7 @@
api-backward-compatibility.patch
+CVE-2026-23745.patch
+CVE-2026-23950.patch
+CVE-2026-29786.patch
+CVE-2026-26960.patch
+CVE-2026-24842.patch
+CVE-2026-31802.patch
--- End Message ---
