node-tar EUVD-2026-42308

The target application must use node-tar in a version prior to 7.5.18 and must process a tar archive containing a PAX extended header where the path or linkpath field is composed entirely of digits. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication is required, but this assumes the application exposes an archive extraction code path to unauthenticated network input - for example, a public file upload endpoint, a package registry endpoint, or a build system that fetches remote archives. Exploitation is limited by the requirement that attacker-controlled content reaches the PAX header parsing code in src/pax.ts; applications that only extract trusted, internally generated archives are not exploitable. The crash impact is further limited by the application's error handling: processes with uncaught exception handlers may degrade gracefully rather than terminate entirely.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a low-complexity, unauthenticated, network-reachable denial of service with limited availability impact. The A:L rating is appropriate because the crash is scoped to the tar extraction operation and process rather than the entire system. No EPSS data was provided, so exploitation probability cannot be quantified beyond inference from the CVSS metrics. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified. The source tags include 'Information Disclosure,' which directly conflicts with the CVSS C:N metric - this discrepancy is unresolved and should be verified against the vendor advisory GHSA-w8wr-v893-vjvp; at time of analysis, available evidence supports availability impact only. Real-world priority depends heavily on deployment context: applications that accept and extract tar archives from untrusted external sources (file upload endpoints, CI/CD pipelines processing remote artifacts, package management tooling) face meaningful denial-of-service exposure, while applications that only process internally generated archives have negligible risk.

An attacker crafts a tar archive in PAX format where the extended header sets the path field to an all-digit value such as '12345'. When this archive is submitted to a web application or CI pipeline that uses node-tar prior to 7.5.18 to extract uploaded archives, the library coerces the path to the JavaScript number 12345, causing normalizeWindowsPath() to invoke .split('/') on a Number object, throwing an uncaught TypeError that crashes the extraction process and potentially the surrounding Node.js worker. No public proof-of-concept has been identified, but the attack primitive is trivially constructable by any attacker with knowledge of the PAX tar format.