node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution sem…

CVE-2026-24842 affects node-tar, a Tar library for Node.js, in versions prior to 7.5.7. The vulnerability stems from a mismatch between security checks and hardlink creation logic for path resolution. This allows attackers to craft malicious TAR archives that bypass path traversal protections and create hardlinks to arbitrary files outside the extraction directory. The issue has been fixed in version 7.5.7.