What’s Vulnerable › Products

isaacs node-tar vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your isaacs node-tar version is affected

Latest isaacs node-tar vulnerabilities

• CVE-2026-73566 — node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection (CVSS 7.5)
• CVE-2026-59875 — node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records (CVSS 5.3)
• CVE-2026-59874 — node-tar: Negative tar entry size causes infinite loop in archive replace (CVSS 7.5)
• CVE-2026-59873 — node-tar: Decompression/parse DoS via unlimited input (CVSS 7.5)
• CVE-2026-59871 — node-tar: Process crash via PAX numeric path type confusion (CVSS 7.5)
• CVE-2026-53655 — node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) (CVSS 5.5)
• CVE-2026-31802 — node-tar Symlink Path Traversal via Drive-Relative Linkpath (CVSS 5.5)
• CVE-2026-29786 — node-tar: Hardlink Path Traversal via Drive-Relative Linkpath (CVSS 6.3)
• CVE-2026-26960 — node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction (CVSS 7.1)
• CVE-2026-24842 — node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal (CVSS 8.2)
• CVE-2026-23950 — node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS (CVSS 5.9)
• CVE-2026-23745 — node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization (CVSS 6.1)
• CVE-2025-64118 — node-tar vulnerable to race condition leading to uninitialized memory exposure (CVSS 6.1)
• CVE-2024-28863 — node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation (CVSS 6.5)
• CVE-2018-20834 — Arbitrary File Overwrite in tar (CVSS 7.5)