isaacs node-tar
14 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-73566 | < 7.5.21 | node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection | HIGH 7.5 | 0.5 % | ||
| CVE-2026-59871 | < 7.5.18 | node-tar: Process crash via PAX numeric path type confusion | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59874 | < 7.5.18 | node-tar: Negative tar entry size causes infinite loop in archive replace | HIGH 8.7 | 0.4 % | ||
| CVE-2026-59873 | < 7.5.19 | node-tar: Decompression/parse DoS via unlimited input | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-59875 | < 7.5.17 | node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-53655 | < 7.5.16 | node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file … | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-31802 | < 7.5.11 | node-tar Symlink Path Traversal via Drive-Relative Linkpath | HIGH 8.2 | 0.3 % | ||
| CVE-2026-29786 | < 7.5.10 | node-tar: Hardlink Path Traversal via Drive-Relative Linkpath | HIGH 8.2 | 0.5 % | ||
| CVE-2026-26960 | < 7.5.8 | node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction | HIGH 7.1 | 0.3 % | ||
| CVE-2026-24842 | < 7.5.7 | node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal | HIGH 8.2 | 0.6 % | ||
| CVE-2026-23950 | < 7.5.4 | node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS | HIGH 8.8 | 0.3 % | ||
| CVE-2026-23745 | < 7.5.3 | node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | HIGH 8.2 | 0.4 % | ||
| CVE-2025-64118 | = 7.5.1 | node-tar vulnerable to race condition leading to uninitialized memory exposure | MEDIUM 6.1 | 0.1 % | ||
| CVE-2024-28863 | < 6.2.1 | node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation | MEDIUM 6.5 | 0.9 % |