CVE-2026-31802 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-31802	HIGH	tar	6.2.1	7.5.11	2026-03-10T07:44:58.02Z	2026-03-11T10:18:19.006527803Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:cf6459f182e22a52e2bfd10576477c3c70f05ab404d8695bc16b6480c7d37505
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:4f78a2edca6966a4ee0f056562d8510267df8f39c90df00f23d52f0b581cbeeb
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:cf6459f182e22a52e2bfd10576477c3c70f05ab404d8695bc16b6480c7d37505
public.ecr.aws/lambda/nodejs:20	public.ecr.aws/lambda/nodejs@sha256:5643651ce243fcd5b6209cd5ac348cb2e66a7a9eb8f050c470ad4d19e993c5e4

---

Description

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.

---

Remediation Steps

• Update the affected package tar from version 6.2.1 to 7.5.11.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.