npm

tar

Security advisories for tar, newest first. 12 known, all fixed. If you’re on 7.5.21 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

7.5.22

Advisories

12 · 0 unfixed

Last advisory

24 Jul 2026

Safe from

7.5.21

12 advisories · newest first

HIGH7.5 24 Jul 2026

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

GHSA-r292-9mhp-454m · CVE-2026-73566

Affected

< 7.5.21

Fixed in

7.5.21

Published

24 Jul 2026

MODERATE5.3 20 Jul 2026

node-tar: Process crash via PAX numeric path type confusion

GHSA-w8wr-v893-vjvp · CVE-2026-59871

Affected

< 7.5.18

Fixed in

7.5.18

Published

20 Jul 2026

CRITICAL7.5 20 Jul 2026

node-tar: Decompression/parse DoS via unlimited input

GHSA-23hp-3jrh-7fpw · CVE-2026-59873

Affected

< 7.5.19

Fixed in

7.5.19

Published

20 Jul 2026

HIGH7.5 20 Jul 2026

node-tar: Negative tar entry size causes infinite loop in archive replace

GHSA-8x88-c5mf-7j5w · CVE-2026-59874

Affected

< 7.5.18

Fixed in

7.5.18

Published

20 Jul 2026

MODERATE5.3 20 Jul 2026

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

GHSA-gvwx-54wh-qm9j · CVE-2026-59875

Affected

< 7.5.17

Fixed in

7.5.17

Published

20 Jul 2026

MODERATE 15 Jun 2026

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

GHSA-vmf3-w455-68vh · CVE-2026-53655

Affected

< 7.5.16

Fixed in

7.5.16

Published

15 Jun 2026

HIGH 10 Mar 2026

node-tar Symlink Path Traversal via Drive-Relative Linkpath

GHSA-9ppj-qmqm-q256 · CVE-2026-31802

Affected

< 7.5.11

Fixed in

7.5.11

Published

10 Mar 2026

HIGH 5 Mar 2026

tar has Hardlink Path Traversal via Drive-Relative Linkpath

GHSA-qffp-2rhf-9h96 · CVE-2026-29786

Affected

< 7.5.10

Fixed in

7.5.10

Published

5 Mar 2026

HIGH7.1 18 Feb 2026

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

GHSA-83g3-92jg-28cx · CVE-2026-26960

Affected

< 7.5.8

Fixed in

7.5.8

Published

18 Feb 2026

HIGH8.2 28 Jan 2026

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

GHSA-34x7-hfp2-rc4v · CVE-2026-24842

Affected

< 7.5.7

Fixed in

7.5.7

Published

28 Jan 2026

HIGH8.8 21 Jan 2026

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

GHSA-r6q2-hw4h-h46w · CVE-2026-23950

Affected

< 7.5.4

Fixed in

7.5.4

Published

21 Jan 2026

HIGH 16 Jan 2026

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

GHSA-8qq5-rm4j-mr97 · CVE-2026-23745

Affected

< 7.5.3

Fixed in

7.5.3

Published

16 Jan 2026

/advisories/npm/tar/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →