Vuln CVE-2026-24842 CVE-2026-25547

[sprintfalcon]

Version

24.13.1

Platform

x86_64 Linux

Subsystem

tar, @isaacs/brace-expansion

What steps will reproduce the bug?

AWS scanner finds these two vulnerabilities on an image running the latest 24.13.1 build.
HIGH: CVE-2026-24842 tar: Installed version / Fixed version 0:7.5.4 / 7.5.7
CRIT: CVE-2026-25547 @isaacs/brace-expansion: Installed version / Fixed version 0:5.0.0 / 5.0.1

How often does it reproduce? Is there a required condition?

n/a

What is the expected behavior? Why is that the expected behavior?

latest fixed versions of node modules installed in the node base

What do you see instead?

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Additional information

No response