CVE-2026-23950: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

January 21, 2026 (updated March 16, 2026)

TITLE: Race Condition in node-tar Path Reservations via Unicode Sharp-S (ß) Collisions on macOS APFS

AUTHOR: Tomás Illuminati

References

github.com/advisories/GHSA-r6q2-hw4h-h46w
github.com/isaacs/node-tar
github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6
github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w
nvd.nist.gov/vuln/detail/CVE-2026-23950

Code Behaviors & Features

Detect and mitigate CVE-2026-23950 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →