node-tar EUVD-2026-42303

Exploitation requires that the target application use node-tar prior to version 7.5.17 to extract an attacker-supplied or attacker-influenced tar archive containing PAX extended headers. Specifically, the archive must use the PAX format (not the legacy POSIX ustar format) with NUL bytes embedded in the path or linkpath header fields - this is a non-default archive structure that must be deliberately crafted. The CVSS vector (PR:N, UI:N) confirms no authentication or victim interaction is required once the malicious archive reaches the extraction code path; however, the attacker must control or influence the archive input to the application (e.g., via file upload endpoint, package fetch, or pipeline artifact). Exploitation is strictly limited to denial of service (process termination); no confidentiality or integrity impact exists per the confirmed C:N/I:N CVSS metrics. Standard tar archives without PAX headers or without NUL bytes in header fields are unaffected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L yields a base score of 5.3, reflecting straightforward network-reachable exploitation with no authentication barrier and limited impact. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, so no confirmed active exploitation exists. The Availability:Low rating in the CVSS vector may understate practical impact: in long-running Node.js services, an uncaught exception from a single malicious archive terminates the entire process rather than just degrading throughput - an outcome closer to A:H for persistent services. That said, impact is bounded to DoS with zero confidentiality or integrity consequence (C:N/I:N confirmed by vector). The absence of a required privilege level (PR:N) and user interaction (UI:N) means exploitation is constrained only by the attacker's ability to deliver a malicious archive to the extraction code path. This is a real but narrowly scoped DoS risk, not a code-execution or data-exfiltration concern.

An attacker crafts a tar archive in PAX format with a path or linkpath header field containing an embedded NUL byte and submits it to a web application, CLI tool, or CI pipeline that uses a vulnerable node-tar version to extract user-supplied or remotely fetched archives. When node-tar processes the PAX headers in src/pax.ts, the unsanitized NUL-containing string is passed to fs.lstat or fs.open, producing an uncaught exception that abruptly terminates the Node.js process and denies service to all concurrent users of that instance.