CVE-2026-49982 tmp: Type-confusion bypass of _assertPath in [email protected] allows path traversal via non-string prefix/postfix/template
Type confusion in tmp library allows path traversal via non-string inputs, enabling attackers to create files outside the temporary directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49982?
CVE-2026-49982 is a high-severity path traversal vulnerability in raszi node-tmp, published on 11 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.
Which versions are affected by CVE-2026-49982?
2 open source packages ship an affected version, including tmp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tmp npm | From 0.2.6 | 0.2.7 |
tmp npm | From 0.2.6 | 0.2.7 |
Products include Raszi Tmp.
How do I fix CVE-2026-49982?
Upgrade tmp to 0.2.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49982 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49982 exists.
Other vulnerabilities in raszi node-tmp
Sources
Also known as CLSA-2026-1793207046, ECHO-74e5-bcf8-2c2a, GHSA-7c78-jf6q-g5cm, MINI-3cp6-phcw-7mgg, MINI-pqp9-vfxx-795h, MINI-vhg5-44q3-7ww6 and 4 more.