CVE-2026-49982

Name of the Vulnerable Software and Affected Versions tmp version 0.2.6

Description A type-confusion issue exists in the assertPath guard. The guard only rejects string values containing the substring .., allowing it to be bypassed when prefix, postfix, or template are supplied as non-string values (such as Array, Buffer, or other objects). If these values return falsy for includes('..') but contain ../ upon stringification, they flow through Array.prototype.join or string coercion within generateTmpName and path.join(tmpDir, opts.dir, name). This results in a path traversal that escapes the temporary directory, enabling the creation of files or directories at attacker-controlled locations with the privileges of the host process. This occurs in applications that forward untrusted request data into the functions tmp.file(), tmp.fileSync(), tmp.dir(), tmp.dirSync(), tmp.tmpName(), or tmp.tmpNameSync() without explicit type coercion.

Recommendations Update to version 0.2.7. As a temporary workaround, implement explicit type coercion for the prefix, postfix, and template variables before passing them to the affected functions.