node-tar vulnerabilities (Debian)

19 vulnerabilities.

• node-tar Debian node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection CVE-2026-73566 Fix available 7.5 HighJuly 24, 2026
• node-tar Debian node-tar: Process crash via PAX numeric path type confusion CVE-2026-59871 Fix available 5.3 MediumJuly 8, 2026
• node-tar Debian node-tar: Negative tar entry size causes infinite loop in archive replace CVE-2026-59874 Fix available 8.7 HighJuly 8, 2026
• node-tar Debian node-tar: Decompression/parse DoS via unlimited input CVE-2026-59873 Fix available 9.2 CriticalJuly 8, 2026
• node-tar Debian node-tar Symlink Path Traversal via Drive-Relative Linkpath CVE-2026-31802 Public exploitFix available 8.2 HighMarch 9, 2026
• node-tar Debian node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVE-2026-29786 Public exploitFix available 8.2 HighMarch 5, 2026
• node-tar Debian node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction CVE-2026-26960 Fix available 7.1 HighFebruary 18, 2026
• node-tar Debian node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal CVE-2026-24842 Fix available 8.2 HighJanuary 28, 2026
• node-tar Debian node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS CVE-2026-23950 Fix available 8.8 HighJanuary 20, 2026
• node-tar Debian node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation CVE-2024-28863 Fix available 6.5 MediumMarch 21, 2024
• node-tar Debian Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37712 Fix available 8.2 HighAugust 31, 2021
• node-tar Debian Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37701 Fix available 8.2 HighAugust 31, 2021
• node-tar Debian Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization CVE-2021-32804 Public exploitFix available EPSS 15.1% 8.2 HighAugust 3, 2021
• node-tar Debian Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning CVE-2021-32803 Fix available 8.2 HighAugust 3, 2021
• node-tar Debian node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records CVE-2026-59875 Fix available 5.3 MediumApril 3, 2020
• node-tar Debian node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) CVE-2026-53655 Fix available 6.9 MediumApril 3, 2020
• node-tar Debian node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization CVE-2026-23745 Public exploitFix available 8.2 HighApril 3, 2020
• node-tar Debian Arbitrary File Overwrite in tar CVE-2018-20834 Fix available 7.5 HighApril 30, 2019
• node-tar Debian Symlink Arbitrary File Overwrite in tar CVE-2015-8860 Fix available 7.5 HighJanuary 23, 2017