CVE-2026-49982: tmp Node.js Path Traversal — Remote File Creation Vulnerability

Technical summary

CVE-2026-49982 exploits a type-confusion vulnerability in tmp's _assertPath validation function. The guard specifically rejects string values containing '..' but does not apply the same validation to Array, Buffer, or generic object types. During path generation in _generateTmpName, these non-string objects undergo implicit String coercion via Array.prototype.join and String conversion, which can produce output containing '../' sequences that the initial guard never inspected. These malformed paths then flow into path.join(tmpDir, opts.dir, name), where the path traversal sequences are normalized and resolved relative to the file system, enabling arbitrary file or directory creation. The vulnerability manifests when applications directly pass untrusted input (such as deserialized JSON objects or parsed query parameters) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without type-checking.

Business impact

For organizations using Node.js applications built on the tmp library, this vulnerability creates a critical integrity and availability risk. Attackers can write arbitrary files to the server, potentially overwriting application code, configuration files, or system binaries—leading to remote code execution or application compromise. Alternatively, attackers could exhaust disk space or corrupt essential system files, causing denial of service. The attack surface is broad: any web application that deserializes user input and passes it to tmp functions without validation is affected. This is especially concerning for APIs that accept JSON payloads or query strings with array-like structures.

Affected systems

The tmp package version 0.2.6 and earlier are affected. Any Node.js application using these versions is vulnerable if it forwards untrusted input (from HTTP requests, external APIs, or file uploads) into tmp functions without explicit type coercion or validation. The risk is highest for web servers and backend services that process JSON bodies or query parameters with minimal input sanitization. Applications using tmp only for internal, controlled purposes (e.g., hardcoded paths) are not at risk.

Exploitability

This vulnerability is relatively straightforward to exploit. An attacker needs only to craft a malicious request containing a non-string value in a field that the application passes to a tmp function. For example, sending ?prefix[]=../../../etc/passwd or a JSON body with {"prefix": ["../../../"]} can trigger the vulnerability. No authentication or special privileges are required, and exploitation does not depend on race conditions or user interaction. The attack is reliable and repeatable, making it a practical threat in the wild.

Remediation

Update the tmp package to version 0.2.7 or later immediately. This version includes a corrected validation function that properly handles non-string inputs. Additionally, apply defense-in-depth measures: ensure all application code that accepts external input performs explicit type checking before passing values to tmp functions, and consider restricting file creation to specific, read-only temporary directories using OS-level permissions or containerization.

Patch guidance

Verify your Node.js project's package.json and package-lock.json to confirm the tmp package version. If any version 0.2.6 or earlier is in use, run npm update tmp or npm install [email protected] (or the latest available version). Re-run your test suite to ensure compatibility. If your application is subject to strict change management, prioritize this update as a high-priority security patch. No breaking changes are expected when upgrading from 0.2.6 to 0.2.7; however, verify against the vendor advisory for any edge cases in your specific usage patterns.

Detection guidance

Monitor for suspicious file or directory creation attempts in temporary directories and their parent paths. Log all tmp function calls with their input parameters; anomalies such as Array or Buffer objects (or objects with unusual toString() representations) being passed as options should trigger alerts. On running systems, audit the file system for unexpected files outside of designated temp directories that were created around the time of suspicious requests. In application logs, look for error messages from path.join() or file system operations that contain '../' or similar traversal patterns in unexpected contexts.

Why prioritize this

This vulnerability scores 8.2 (HIGH) due to its network accessibility, lack of authentication requirement, and significant impact on integrity and availability. The ease of exploitation and broad applicability across Node.js web applications make it a strong candidate for immediate patching. Organizations running production services that accept external input should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: (1) network vector (AV:N) — no local access required; (2) low attack complexity (AC:L) — no special conditions or race windows needed; (3) no privileges or user interaction required (PR:N, UI:N); (4) high integrity impact (I:H) — arbitrary file creation/modification; (5) low availability impact (A:L) — potential for denial of service through disk exhaustion or file corruption. The vulnerability does not disclose confidentiality (C:N), hence the score does not reach critical severity, but the integrity and availability consequences are substantial.

Frequently asked questions