CVE-2026-49982: raszi node-tmp Improper Input Validation
Vulnerability summary
CVE-2026-49982 is a high (CVSS 8.2) Improper Input Validation vulnerability in raszi node-tmp. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 11-06-2026PublishedVulnerability first disclosed.
- 11-06-2026Last modifiedVulnerability information updated.
Description
tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- OSV · NpmEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.10 pp
From 0.50% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNode Tmp
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Chainguard40 products
- arangodb-3.12< 3.12.9.4-r25
- authentik-2026.2< 2026.2.5-r2
- authentik-2026.5< 2026.5.3-r6
- authentik-fips-2026.5< 2026.5.3-r5
- lerna< 9.0.7-r9
Wolfi7 products
- lerna< 9.0.7-r9
- opensearch-dashboards-3-dashboards-reporting< 3.7.0-r0
- prism< 5.15.11-r3
- pulumi-language-nodejs< 3.246.0-r1
- saf< 1.6.0-r1
Npm1 product
- tmp≥ 0.2.6, < 0.2.7
Ubuntu1 product
- node-tmpAll versions (No fix recorded)
5 vendors · 51 products
References
6 links- github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cmX Refsource CONFIRMREPORTAdvisoryWEBExploitMitigationVendor Advisory
- github.com/raszi/node-tmpPACKAGE