GHSA-r292-9mhp-454m

Medium

Published: —Translated: 03/08/2026(UTC)NVD NIST

Summary

Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.

Risk Assessment

An attacker can cause application crash via stack exhaustion, leading to denial of service (DoS).

Recommendation

It is recommended to upgrade the node-tar library to a version that includes a fix limiting recursion.

Original NVD description (English source)

## Summary `node-tar` (npm `tar`) contains an uncontrolled-recursion stack-exhaustion DoS in the internal `mapHas` helper used by `filesFilter`. When a consumer calls `tar.t(...)` or `tar.x(...)` with a non-empty member-selection list, node-tar installs a filter that closes over the recursive `mapHa