8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49982

CVE-2026-49982: tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49982

CVE-2026-49982:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tmp	npm	>= 0.2.6, < 0.2.7	0.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a type-confusion issue in the tmp library, specifically within the _assertPath function. This function was designed to prevent path traversal attacks by checking for .. in user-supplied options like prefix, postfix, and template. However, it did not verify that the input was a string before performing the check.

An attacker can exploit this by providing a non-string value, such as a JavaScript array (e.g., ['../escape']). The Array.prototype.includes('..') method checks for the literal element '..' in the array, which is not present, so the check passes. Subsequently, in the _generateTmpName function, this array is joined into a string, re-forming the malicious path ../escape.

The vulnerable execution flow starts when a user-facing function like tmp.file() or tmp.dir() is called with malicious options. These options are processed by _assertOptionsBase, which then calls the flawed _assertPath. The bypassed value is then used in _generateTmpName to construct a path outside the intended temporary directory.

The patch addresses this by modifying _assertPath to strictly enforce that its input is a string, throwing an error if it is not. This ensures the .includes('..') check is always performed on a string, effectively preventing the type-confusion bypass.

Vulnerable functions

_assertPath

lib/tmp.js

This function is the root cause of the vulnerability. It was intended to prevent path traversal by checking for '..' in path-related options. However, it failed to validate that the input was a string before calling `.includes()`. This allows an attacker to supply a non-string value, like an array or a crafted object, to bypass the security check. For example, for an array input like `['../foo']`, the `Array.prototype.includes('..')` method returns `false`, defeating the check. The input is later coerced to a string, reintroducing the path traversal characters.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.