CVE-2026-29786 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-29786	HIGH	tar	6.2.1	7.5.10	2026-03-07T16:15:55.587Z	2026-03-08T10:18:18.777455977Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:cf6459f182e22a52e2bfd10576477c3c70f05ab404d8695bc16b6480c7d37505
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:4f78a2edca6966a4ee0f056562d8510267df8f39c90df00f23d52f0b581cbeeb
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:cf6459f182e22a52e2bfd10576477c3c70f05ab404d8695bc16b6480c7d37505
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:5643651ce243fcd5b6209cd5ac348cb2e66a7a9eb8f050c470ad4d19e993c5e4

---

Description

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

---

Remediation Steps

• Update the affected package tar from version 6.2.1 to 7.5.10.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.