Isaacs Tar vulnerabilities

• isaacs node-tar node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection CVE-2026-73566 Fix available 7.5 HighJuly 24, 2026
• isaacs node-tar, tar +1 more node-tar: Process crash via PAX numeric path type confusion CVE-2026-59871 Fix available 5.3 MediumJuly 8, 2026
• isaacs node-tar, tar +1 more node-tar: Negative tar entry size causes infinite loop in archive replace CVE-2026-59874 Fix available 8.7 HighJuly 8, 2026
• isaacs node-tar, tar +1 more node-tar: Decompression/parse DoS via unlimited input CVE-2026-59873 Fix available 9.2 CriticalJuly 8, 2026
• isaacs node-tar, tar +1 more node-tar Symlink Path Traversal via Drive-Relative Linkpath CVE-2026-31802 Public exploitFix available 8.2 HighMarch 9, 2026
• isaacs node-tar, tar, red hat cryostat 4 +20 more +22 more node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVE-2026-29786 Public exploitFix available 8.2 HighMarch 5, 2026
• isaacs node-tar, tar +1 more node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction CVE-2026-26960 Fix available 7.1 HighFebruary 18, 2026
• isaacs node-tar, tar, red hat cryostat 4 +27 more +29 more node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal CVE-2026-24842 Fix available 8.2 HighJanuary 28, 2026
• isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 more node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS CVE-2026-23950 Fix available 8.8 HighJanuary 20, 2026
• isaacs node-tar node-tar vulnerable to race condition leading to uninitialized memory exposure CVE-2025-64118 Fix available 6.1 MediumOctober 30, 2025
• isaacs node-tar, tar +1 more node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation CVE-2024-28863 Fix available 6.5 MediumMarch 21, 2024
• isaacs node-tar, npmjs tar, oracle graalvm +1 more +3 more Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization CVE-2021-37713 Fix available 8.2 HighAugust 31, 2021
• isaacs node-tar, npmjs tar, debian linux +2 more +4 more Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37712 Fix available 8.2 HighAugust 31, 2021
• isaacs node-tar, npmjs tar, debian linux +2 more +4 more Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37701 Fix available 8.2 HighAugust 31, 2021
• isaacs node-tar, tar project tar, oracle graalvm +1 more +3 more Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization CVE-2021-32804 Public exploitFix available EPSS 15.1% 8.2 HighAugust 3, 2021
• isaacs node-tar, tar project tar, oracle graalvm +1 more +3 more Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning CVE-2021-32803 Fix available 8.2 HighAugust 3, 2021
• isaacs node-tar node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records CVE-2026-59875 Fix available 5.3 MediumApril 3, 2020
• isaacs node-tar, tar +1 more node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) CVE-2026-53655 Fix available 6.9 MediumApril 3, 2020
• isaacs node-tar, tar, red hat confidential compute attestation +40 more +42 more node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization CVE-2026-23745 Public exploitFix available 8.2 HighApril 3, 2020
• isaacs tar Arbitrary File Overwrite in tar CVE-2018-20834 Fix available 7.5 HighApril 30, 2019