CVE-2026-73566
published 2026-08-13CVE-2026-73566: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.53%
44.6th percentile
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | toolbox-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| gnu | tar | — | — |
| grafana | grafana | — | — |
| isaacs | node-tar | < 7.5.21 | 7.5.21 |
| mta | mta-cli-rhel9 | — | — |
| mta | mta-generic-external-provider-rhel9 | — | — |
| ocs4 | rhceph-rhel8 | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel8 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73566 kf6-breeze-icons: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 kf6-breeze-icons: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
CVE-2026-73566 kf6-breeze-icons: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts befor
Bugzilla
CVE-2026-73566 tar: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 tar: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
CVE-2026-73566 tar: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CH
Bugzilla
CVE-2026-73566 yarnpkg: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 yarnpkg: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
CVE-2026-73566 yarnpkg: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpac
Bugzilla
CVE-2026-73566 sgx-pccs: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 sgx-pccs: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
CVE-2026-73566 sgx-pccs: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpa
Bugzilla
CVE-2026-73566 rust-tar: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 rust-tar: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
CVE-2026-73566 rust-tar: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack
Bugzilla
CVE-2026-73566 yarnpkg: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 yarnpkg: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
CVE-2026-73566 yarnpkg: node-tar: Denial of Service via crafted long-path tar archive [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[
Bugzilla
CVE-2026-73566 kf6-breeze-icons: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 kf6-breeze-icons: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
CVE-2026-73566 kf6-breeze-icons: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts bef
Bugzilla
CVE-2026-73566 crow-translate: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 crow-translate: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
CVE-2026-73566 crow-translate: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts befor
Bugzilla
CVE-2026-73566 onnxruntime: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 onnxruntime: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
CVE-2026-73566 onnxruntime: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before U
Bugzilla
CVE-2026-73566 rust-tar: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
bugzilla·2026-10-20·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 rust-tar: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
CVE-2026-73566 rust-tar: node-tar: Denial of Service via crafted long-path tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpa
Bugzilla
CVE-2026-73566 tar: node-tar: Denial of Service via crafted long-path tar archive
bugzilla·2026-08-13·CVSS 7.5
CVE-2026-73566 [HIGH] CVE-2026-73566 tar: node-tar: Denial of Service via crafted long-path tar archive
CVE-2026-73566 tar: node-tar: Denial of Service via crafted long-path tar archive
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
2026-08-13
Published