Skip to main content

node-tar EUVDEUVD-2026-58181

| CVE-2026-73566 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-08-13 GitHub_M GHSA-r292-9mhp-454m
Denial Of Service Node.js Node Tar Isaacs
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-accessible service processes an attacker-supplied file with no authentication; sole impact is process termination, so C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Aug 13, 2026 - 19:04 EUVD
Source Code Evidence Fetched
Aug 13, 2026 - 18:21 vuln.today
Analysis Generated
Aug 13, 2026 - 18:21 vuln.today
CVE Published
Aug 13, 2026 - 17:39 cve.org
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 111 npm packages depend on tar (43 direct, 68 indirect)

Ecosystem-wide dependent count for version 7.5.21.

DescriptionCVE.org

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.

Articles & Coverage 1

News 7 New Node.js Vulnerabilities - 1 Critical, 6 High, 4 With POC Aug 14, 2026

AnalysisAI

Stack-exhaustion denial-of-service in node-tar (npm package tar) versions up to and including 7.5.20 allows unauthenticated remote attackers to terminate any Node.js process that lists or extracts selected members from an attacker-controlled archive. The vulnerable mapHas recursion in filesFilter overflows the call stack before any depth guard can execute, and the resulting RangeError is uncatchable by standard try/catch on async and streaming consumers - the dominant server-side usage pattern. A publicly available proof-of-concept demonstrates the crash using a payload of approximately 188 bytes gzipped; no active exploitation confirmed in CISA KEV at time of analysis.

Technical ContextAI

node-tar (CPE: cpe:2.3:a:isaacs:node-tar:*:*:*:*:*:*:*:*) is a foundational npm library for POSIX tar archive manipulation in Node.js. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) manifesting specifically as unbounded call-stack depth. The mapHas helper in src/list.ts:33-44 recursively calls path.dirname() to walk an archive entry path upward one segment per frame with no depth cap. This function is installed as part of filesFilter whenever a caller passes a non-empty member-selection list to tar.t() or tar.x(). The filter is invoked at src/parse.ts:253 inside Parser[CONSUMEHEADER], critically outside the only try/catch in that method (which only wraps new Header at lines 179-183). GNU Long Link (L) and PAX extended (x) headers can encode paths up to maxMetaEntrySize (1 MiB), enabling paths with tens of thousands of slash-separated segments. The Unpack class's maxDepth guard in src/unpack.ts:342 fires only on the 'entry' event, which is emitted after CONSUMEHEADER has already evaluated the filter - so it cannot intercept the overflow. The fix in 7.5.21 introduces a MAX=100 depth constant and passes a depth counter through each mapHas recursive call, short-circuiting and returning false at the limit.

RemediationAI

Upgrade node-tar to version 7.5.21 or later via npm install tar@7.5.21 or npm update tar; this is the vendor-released patch that introduces the MAX=100 recursion cap in mapHas. The authoritative fix commit is https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a. If immediate upgrade is not feasible, the most effective compensating control is to remove non-empty member-selection lists from all tar.t() and tar.x() call sites that process untrusted input, which prevents filesFilter from being installed entirely and eliminates the vulnerable code path - though this requires application-level changes and may alter filtering behavior. A secondary mitigation is to reject or pre-sanitize tar archive entries with path depths exceeding a safe threshold at the ingestion boundary before passing them to node-tar, accepting the trade-off of additional preprocessing overhead.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-58181 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy