npm/tmp CVE-2026-44705: high 8.2, EPSS 0.43%
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Action: Upgrade tmp to 0.2.6 or later.
npm i tmp@0.2.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.2.6 | - |
Fixed versions
| 0.2.6 |
Sources
- osv: GHSA-ph9p-34f9-6g65
- nvd: CVE-2026-44705
- https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65
- https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429
- https://github.com/raszi/node-tmp
CVE-2026-44705 · published · modified · JSON