logo

Database

Improper resource allocation In node-tar

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 17

10

Aliases

1. CVE-2026-735662. NVD-2026-735663. OSV-2026-735664. OSV-DEBIAN-2026-735665. GHSA-r292-9mhp-454m6. GCVE-2026-735667. SECURITY-TRACKER-CVE-2026-73566

References

1. https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m2. https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a3. https://github.com/isaacs/node-tar/releases/tag/v7.5.21

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.