Vuln CVE-2026-24842 CVE-2026-25547

Version

24.13.1

Platform

x86_64 Linux

Subsystem

tar, @isaacs/brace-expansion

What steps will reproduce the bug?

AWS scanner finds these two vulnerabilities on an image running the latest 24.13.1 build.
HIGH: CVE-2026-24842 tar: Installed version / Fixed version 0:7.5.4 / 7.5.7
CRIT: CVE-2026-25547 @isaacs/brace-expansion: Installed version / Fixed version 0:5.0.0 / 5.0.1

How often does it reproduce? Is there a required condition?

n/a

What is the expected behavior? Why is that the expected behavior?

latest fixed versions of node modules installed in the node base

What do you see instead?

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Additional information

No response

No files or tests are named. Start by locating the dependency declarations used to build the Node base image, verify the installed tar and @isaacs/brace-expansion versions, and run the AWS vulnerability scan; done means tar is at least 7.5.7 and @isaacs/brace-expansion is at least 5.0.1.