Skip to main content
cve.nowby Sazabi
← npm
npmPackage

tmp

3 known vulnerabilities (2 high, 1 low), with the versions each affects and the releases that fix them.

Latest release
0.2.7 (May 27, 2026): no advisory affects it
Newest unaffected release
0.2.7 (May 27, 2026), the latest release
Advisories
3 · 2 high, 1 low
Weekly downloads
111.3M
Dependents
32.4K
Releases
40 since 0.0.1 (Sep 2, 2011)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template

    Affected: from 0.2.6, fixed in 0.2.7.

    Fixed in 0.2.7 (released May 27, 2026, 15 days before disclosure).

    The latest release, 0.2.7, is not affected.

    0.6% of tmp downloads last week were affected versions (833.7K).

  • tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

    Affected: fixed in 0.2.6.

    Fixed in 0.2.6 (released May 26, 2026, 16 days before disclosure).

    The latest release, 0.2.7, is not affected.

    51% of tmp downloads last week were affected versions (65.7M).

  • tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter

    Affected: fixed in 0.2.4.

    Fixed in 0.2.4 (released Aug 6, 2025, 1 day before disclosure).

    The latest release, 0.2.7, is not affected.

    37% of tmp downloads last week were affected versions (47.9M).