isaacs node-tar vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 202612

Newest CVEs

• CVE-2026-73566

  node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

  isaacs · node-tar

  High7.5
• CVE-2026-59871

  node-tar: Process crash via PAX numeric path type confusion

  isaacs · node-tar

  Medium5.3
• CVE-2026-59874

  node-tar: Negative tar entry size causes infinite loop in archive replace

  isaacs · node-tar

  High8.7
• CVE-2026-59873

  node-tar: Decompression/parse DoS via unlimited input

  isaacs · node-tar

  Critical9.2
• CVE-2026-59875

  node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

  isaacs · node-tar

  Medium5.3
• CVE-2026-53655

  node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

  isaacs · node-tar

  Medium6.9
• CVE-2026-31802

  node-tar Symlink Path Traversal via Drive-Relative Linkpath

  isaacs · node-tar

  High8.2
• CVE-2026-29786

  node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

  isaacs · node-tar

  High8.2
• CVE-2026-26960

  node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

  isaacs · node-tar

  High7.1
• CVE-2026-24842

  node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

  isaacs · node-tar

  High8.2