CVE-2026-73566
Fixed in a distro release EPSS <1%CVSS 7.5
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
Products: isaacs node-tar
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | tar | 7.5.21 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | nodejs22 | 1:22.23.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs22-devel | 1:22.23.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs22-docs | 1:22.23.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs22-full-i18n | 1:22.23.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs22-libs | 1:22.23.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.9-1.22.23.3.1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs24 | 1:24.22.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs24-devel | 1:24.22.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs24-docs | 1:24.22.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs24-full-i18n | 1:24.22.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs24-libs | 1:24.22.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.0.1.amzn2023.0.1 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.3.1.amzn2023.0.1 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.0.1.amzn2023.0.1 |
| Chainguard | actions-runner | 2.336.0-r2 |
| Chainguard | code-server | 4.130.0-r2 |
| Chainguard | gemini-cli | 0.49.0-r6 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.8-r0 |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | graalvm-25-ce-nodejs | 25.0.4-r2 |
| Chainguard | haraka | 3.3.2-r2 |
| Chainguard | jupyter-base-notebook | 7.6.3-r2 |
| Chainguard | kibana-8.17 | 8.17.10-r31 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r31 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r31 |
| Chainguard | kibana-8.19 | 8.19.18-r2 |
| Chainguard | kibana-8.19-bitnami | 8.19.18-r2 |
| Chainguard | kibana-8.19-iamguarded | 8.19.18-r2 |
| Chainguard | kibana-9.0 | 9.0.8-r34 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r34 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r34 |
| Chainguard | kibana-9.1 | 9.1.10-r30 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r30 |
| Chainguard | kibana-9.2 | 9.2.8-r18 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r18 |
| Chainguard | kibana-9.3 | 9.3.8-r1 |
| Chainguard | kibana-9.3-iamguarded | 9.3.8-r1 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r25 |
| Chainguard | lerna | 9.0.7-r11 |
| Chainguard | node-gyp | 13.0.1-r1 |
| Chainguard | npm | 12.0.1-r2 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r4 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-3 | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 3.7.0-r7 |
| Chainguard | pnpm-stage0 | no fix |
| Chainguard | prism | 5.16.0-r4 |
| Chainguard | pulumi-language-nodejs | 3.253.0-r2 |
| Chainguard | renovate | 44.23.3-r1 |
| Chainguard | renovate | 44.3.3-r0 |
| Chainguard | renovate | 44.3.2-r0 |
| Chainguard | saf | 1.7.0-r0 |
| Chainguard | sqlpad | 7.5.7-r29 |
| Chainguard | tensorflow-gpu-jupyter | 2.21.0-r12 |
| Chainguard | wazuh-dashboard | 4.14.7-r7 |
| Chainguard | wazuh-dashboard-fips | 4.14.7-r7 |
| Debian 12 | node-tar | no fix |
| Debian 13 | node-tar | no fix |
| Debian 14 | node-tar | 7.5.22+~4.0.1-1 |
| Ubuntu 18.04 LTS | node-tar | no fix |
| Ubuntu 22.04 LTS | node-tar | no fix |
| Ubuntu 24.04 LTS | node-tar | no fix |
| Ubuntu 26.04 LTS | node-tar | no fix |
| Ubuntu 26.10 | node-tar | no fix |
| Ubuntu Pro 14.04 LTS | node-tar | no fix |
| Ubuntu Pro 16.04 LTS | node-tar | no fix |
| Ubuntu Pro 20.04 LTS | node-tar | no fix |
| Wolfi | code-server | 4.130.0-r2 |
| Wolfi | jupyter-base-notebook | 7.6.3-r2 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r25 |
| Wolfi | lerna | 9.0.7-r11 |
| Wolfi | node-gyp | 13.0.1-r1 |
| Wolfi | npm | 12.0.1-r2 |
| Wolfi | opensearch-dashboards-3 | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 3.7.0-r7 |
| Wolfi | pnpm-stage0 | no fix |
| Wolfi | prism | 5.16.0-r4 |
| Wolfi | pulumi-language-nodejs | 3.253.0-r2 |
| Wolfi | renovate | 44.3.2-r0 |
| Wolfi | renovate | 44.3.3-r0 |
| Wolfi | renovate | 44.23.3-r1 |
| Wolfi | saf | 1.7.0-r0 |
| Wolfi | sqlpad | 7.5.7-r29 |