CVE-2026-24842 #320
Description
Bump @mapbox/node-pre-gyp to ^2.0.0 to address tar CVE (CVE-2026-24842)
Summary
pprof currently depends on @mapbox/node-pre-gyp: ^1.0.9. The 1.x line of node-pre-gyp uses tar ^6.1.0, which is vulnerable to CVE-2026-24842 (path traversal when extracting tar archives).
@mapbox/node-pre-gyp 2.x already uses tar ^7.4.0, which includes the fix. Bumping pprof’s dependency to @mapbox/node-pre-gyp: ^2.0.0 would resolve the CVE for downstreams without requiring lockfile overrides.
Impact
Downstream users (e.g. via @google-cloud/profiler) currently have to add a pnpm/npm override like "tar": ">=7.5.7" to satisfy security scanners. Fixing this in pprof would allow removing that override.
Note on compatibility
- node-pre-gyp 2.x requires Node.js >= 18 (see their package.json).
- pprof 4.0.0 currently supports Node 14+. If you bump to node-pre-gyp 2.x, you may want to document that a future release requires Node 18+ (or bump pprof’s engines field accordingly).
References
- CVE-2026-24842 – node-tar path traversal
- node-pre-gyp 2.x uses tar ^7.4.0
- node-pre-gyp #597 – earlier tar CVE discussion (1.x line)