CVE-2026-23745

Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.

node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.

The node-tar library before version 7.5.17 does not strip NUL bytes from PAX path and linkpath records, allowing a crafted archive to cause an uncaught exception and terminate the Node.js process.

The node-tar library before version 7.5.18 accepts a tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.

The node-tar library before version 7.5.19 does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio during extraction and parsing. This allows a small crafted gzip bomb to exhaust disk space and CPU.

The node-tar library before version 7.5.18 coerces all-digit PAX path and linkpath values to JavaScript numbers, causing a TypeError during path processing. The issue is fixed in version 7.5.18.

A vulnerability in node-tar prior to version 7.5.10 allows an attacker to create a hardlink pointing outside the extraction directory by using a drive-relative link target such as C:../target.txt. This enables file overwrite outside the current working directory during normal tar.x() extraction.

A vulnerability in node-tar (Tar for Node.js) prior to version 7.5.7 arises from a mismatch between the security check for hardlink entries and the actual hardlink creation logic. This allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory.

The node-tar library (Tar for Node.js) versions up to and including 7.5.3 contain a race condition vulnerability due to incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems (e.g., macOS APFS), an attacker can exploit conflicting filenames (e.g., 'ß' and 'ss') to bypass concurrency locks and perform Symlink Poisoning attacks, leading to arbitrary file overwrite.