CVE-2026-24842

Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.

node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.

The node-tar library before version 7.5.17 does not strip NUL bytes from PAX path and linkpath records, allowing a crafted archive to cause an uncaught exception and terminate the Node.js process.

The node-tar library before version 7.5.18 accepts a tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.

The node-tar library before version 7.5.19 does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio during extraction and parsing. This allows a small crafted gzip bomb to exhaust disk space and CPU.

The node-tar library before version 7.5.18 coerces all-digit PAX path and linkpath values to JavaScript numbers, causing a TypeError during path processing. The issue is fixed in version 7.5.18.

A vulnerability in node-tar prior to version 7.5.10 allows an attacker to create a hardlink pointing outside the extraction directory by using a drive-relative link target such as C:../target.txt. This enables file overwrite outside the current working directory during normal tar.x() extraction.

The node-tar library (Tar for Node.js) versions up to and including 7.5.3 contain a race condition vulnerability due to incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems (e.g., macOS APFS), an attacker can exploit conflicting filenames (e.g., 'ß' and 'ss') to bypass concurrency locks and perform Symlink Poisoning attacks, leading to arbitrary file overwrite.

In node-tar library up to version 7.5.2, the linkpath of Link (hardlink) and SymbolicLink entries is not sanitized when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets.