EUVD-2026-42303
GHSA-gvwx-54wh-qm9j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-delivered crafted archive requires no auth; impact is process termination only, no confidentiality or integrity loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 16 npm packages depend on tar (12 direct, 4 indirect)
Ecosystem-wide dependent count for version 7.5.17.
DescriptionCVE.org
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
AnalysisAI
Process termination via crafted tar archive affects node-tar prior to 7.5.17, where NUL bytes in PAX path and linkpath header records are not sanitized before being passed to Node.js filesystem calls. Any application using node-tar to extract untrusted archives is susceptible to denial of service through an uncaught exception that crashes the Node.js process. No confirmed active exploitation or public exploit code has been identified at time of analysis; however, the low attack complexity (CVSS AC:L, PR:N) makes this trivial to trigger wherever attacker-controlled archive input reaches a vulnerable node-tar instance.
Technical ContextAI
node-tar (CPE: cpe:2.3:a:isaacs:node-tar:*:*:*:*:*:*:*:*) is a JavaScript library for reading and writing POSIX tar archives in Node.js, widely embedded in npm tooling, build pipelines, and deployment automation. The PAX extended header format (POSIX.1-2001) permits arbitrary metadata in archives, including extended path and link path values encoded in UTF-8. The defect resides in src/pax.ts, where PAX path and linkpath field values are not stripped of embedded NUL bytes (0x00) before being forwarded to fs.lstat or fs.open. In Node.js, NUL bytes in path strings passed to libuv cause the underlying OS system call to truncate the path at the NUL - rather than returning a handled POSIX error, this path triggers an uncaught exception classified under CWE-248 (Uncaught Exception). Because Node.js does not catch this exception at the library boundary, the entire hosting process terminates. The 'Information Disclosure' tag present in source metadata conflicts with the CVSS vector (C:N); the actual impact is exclusively availability-class.
RemediationAI
Upgrade node-tar to version 7.5.17 or later via npm (npm install node-tar@7.5.17 or yarn upgrade node-tar@7.5.17). The patched release is confirmed at https://github.com/isaacs/node-tar/releases/tag/v7.5.17 and the fix commit is at https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3. If an immediate upgrade is blocked, a targeted compensating control is to validate PAX header field values and reject any archive containing NUL bytes (0x00) in path or linkpath fields before passing the archive to node-tar - this requires pre-processing logic at the application layer and adds latency. A second compensating control is to execute node-tar extraction in an isolated child process or worker thread; a crash in that worker will not terminate the main application process, providing fault isolation without fixing the bug. Neither workaround removes the underlying defect and both add maintenance burden; patching to 7.5.17 is the definitive fix.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-248 – Uncaught Exception
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today