isaacs/node-tar Security Advisories | GitStock

high2026-07-24

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

GHSA-r292-9mhp-454m · CVE-2026-73566

medium2026-07-20

node-tar: Process crash via PAX numeric path type confusion

GHSA-w8wr-v893-vjvp · CVE-2026-59871

critical2026-07-20

node-tar: Decompression/parse DoS via unlimited input

GHSA-23hp-3jrh-7fpw · CVE-2026-59873

high2026-07-20

node-tar: Negative tar entry size causes infinite loop in archive replace

GHSA-8x88-c5mf-7j5w · CVE-2026-59874

medium2026-07-20

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

GHSA-gvwx-54wh-qm9j · CVE-2026-59875

medium2026-06-15

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

GHSA-vmf3-w455-68vh · CVE-2026-53655

high2026-03-10

node-tar Symlink Path Traversal via Drive-Relative Linkpath

GHSA-9ppj-qmqm-q256 · CVE-2026-31802

high2026-03-05

tar has Hardlink Path Traversal via Drive-Relative Linkpath

GHSA-qffp-2rhf-9h96 · CVE-2026-29786

high2026-02-18

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

GHSA-83g3-92jg-28cx · CVE-2026-26960

high2026-01-28

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

GHSA-34x7-hfp2-rc4v · CVE-2026-24842

high2026-01-21

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

GHSA-r6q2-hw4h-h46w · CVE-2026-23950

high2026-01-16

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

GHSA-8qq5-rm4j-mr97 · CVE-2026-23745

medium2025-10-30

node-tar has a race condition leading to uninitialized memory exposure

GHSA-29xp-372q-xqph · CVE-2025-64118

medium2024-03-22

Denial of service while parsing a tar file due to lack of folders count validation

GHSA-f5x3-32g6-xq36 · CVE-2024-28863