CVE-2026-73566
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.
Risk Assessment
An attacker can deliver a malicious tar archive that crashes Node.js applications, leading to service unavailability. This can be used for DoS attacks.
Recommendation
Upgrade the node-tar library to version 7.5.21 or later, which contains the fix.
Original NVD description (English source)
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.