CVE-2026-23950: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23950 is a race condition vulnerability in node-tar (Tar for Node.js) titled "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS," discovered by researcher Tomás Illuminati and disclosed on January 19, 2026. It affects all versions of the tar npm package up to and including 7.5.3, with version 7.5.4 containing the fix. The vulnerability is specific to macOS systems using APFS or HFS+ filesystems. CVSS scores differ by source: NVD assigns 5.9 (Medium) while GitHub (CNA) assigns 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incomplete Unicode normalization in the PathReservations system (CWE-176, CWE-367), which is designed to serialize file operations for the same path to prevent race conditions. In path-reservations.ts, paths are normalized using normalizeUnicode(p) followed by .toLowerCase(), but this uses NFD normalization — which treats ß and ss as distinct strings — while macOS APFS treats them as the same inode. An attacker crafts a malicious tar archive containing two entries with Unicode-colliding filenames (e.g., collision_ss and collision_ß): because node-tar's locking system does not recognize these as the same path, it processes them in parallel, bypassing the concurrency safeguard and enabling a symlink poisoning attack. The patch in version 7.5.4 updates normalize-unicode.ts to apply .normalize('NFD').toLocaleLowerCase('en').toLocaleUpperCase('en'), ensuring ligature characters like ß are expanded to their multi-character equivalents (SS) before path comparison (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to perform arbitrary file overwrites on the target system by supplying a crafted tar archive with Unicode-colliding filenames. The primary impact is high integrity loss — an attacker can overwrite sensitive files accessible to the process performing the extraction, potentially including configuration files, scripts, or binaries, which could lead to privilege escalation or persistent access. Confidentiality and availability impacts are limited but possible as secondary consequences of file overwrite. The vulnerability is scoped to macOS systems running APFS or HFS+ filesystems; Linux and Windows systems are not affected by this specific issue (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating the race condition using a crafted tar stream with collision_ss and collision_ß entries and a high jobs count to maximize parallel processing (GitHub Advisory). There is no evidence of active in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), placing it in the 1st percentile for exploitation likelihood. Exploitation requires user interaction (a victim must extract a malicious archive) and is limited to macOS APFS/HFS+ environments, which constrains the attack surface.

1. Craft a malicious tar archive: Create a tar archive containing two entries with Unicode-colliding filenames — one using a standard ASCII equivalent (e.g., collision_ss) and one using a Unicode ligature that APFS treats as the same inode (e.g., collision_ß). One entry should be a SymbolicLink pointing to a target file to overwrite, and the other a regular file with attacker-controlled content.
2. Configure high parallelism: Set the jobs parameter to a high value (e.g., 8) in the tar extraction options to maximize the likelihood that both entries are processed concurrently, exploiting the race window.
3. Deliver the archive to the victim: Trick a user or automated process on a macOS APFS/HFS+ system into extracting the malicious archive using a vulnerable version of node-tar (≤ 7.5.3). This could be via a supply chain attack, a malicious download, or a compromised package.
4. Race condition triggers: Because node-tar's PathReservations system uses NFD normalization and does not recognize ß and ss as colliding paths, both entries are processed in parallel without proper locking, bypassing the concurrency safeguard.
5. Achieve arbitrary file overwrite: The symlink entry is written first, pointing to a sensitive target file (e.g., a configuration file or script). The second entry's content is then written through the symlink, overwriting the target file with attacker-controlled data, potentially enabling privilege escalation or persistent access (GitHub Advisory, Patch Commit).

• File System: Unexpected files or modified files in directories where tar extraction occurred, particularly files with names containing Unicode ligature characters (e.g., ß, ff, fi, fl); presence of unexpected symbolic links in extraction directories pointing outside the intended extraction path; files with mismatched inodes suggesting inode collision on APFS.
• Logs: Node.js application logs showing tar extraction of archives containing both Unicode ligature filenames and their ASCII equivalents (e.g., entries named *ß* and *ss* in the same archive); unexpected file modification timestamps on sensitive configuration files coinciding with tar extraction events.
• Process: Node.js processes spawning with high jobs values during tar extraction; unexpected file write operations to paths outside the intended extraction directory, observable via file integrity monitoring tools (e.g., auditd on macOS or similar).
• Network: Receipt of tar archives from untrusted or unexpected sources containing Unicode characters in filenames, detectable via network inspection or download logging.

Upgrade the tar npm package to version 7.5.4 or later, which fixes the normalization logic in path-reservations.js to correctly handle Unicode ligature collisions (GitHub Advisory, Patch Commit). As a workaround for those unable to upgrade immediately, filter out all SymbolicLink entries from tar archives before extraction (as npm itself does), which prevents the symlink poisoning vector. Additionally, restrict tar extraction to Linux or Windows systems where this filesystem normalization issue does not apply, or validate archive contents for suspicious Unicode filenames prior to extraction. Red Hat has addressed this in RHEL 10 via RHSA-2026:18480 and RHEL 9 via RHSA-2026:18868 (Red Hat Bugzilla). Multiple IBM products have also released patches addressing this dependency (IBM Watson Discovery).

The vulnerability was reported by researcher Tomás Illuminati and credited in the GitHub security advisory (GitHub Advisory). The Hacker Wire published a dedicated technical write-up on the symlink poisoning mechanism (The Hacker Wire). The vulnerability attracted attention from the AWS Lambda base images team, with a related issue filed on GitHub, and was included in CISA's weekly vulnerability bulletin for the week of January 19, 2026. Multiple downstream vendors including IBM and Atlassian issued advisories for affected products incorporating node-tar (Atlassian Advisory).