Skip to content
OpenAdvisories

Product · isaacs

node-tar

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2026-73566

    node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) recei…

    isaacs node-tar renovate prism Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-59874

    node-tar: Negative tar entry size causes infinite loop in archive replace

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.…

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-31802 Public exploit

    node-tar Symlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file over…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.2
    CVE-2026-29786 Public exploit

    node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside …

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 7.1
    CVE-2026-26960

    node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary fil…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-24842

    node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

    node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicio…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Alpine Wolfi npm
  • High 8.8
    CVE-2026-23950

    node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

    node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesyst…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-23745 Public exploit

    node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root r…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm