CVE-2026-73566 in node-tar
Summary
by MITRE • 08/13/2026
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The node-tar library presents a critical vulnerability in its handling of archive entry paths through improper recursive traversal mechanisms. This flaw manifests when the filesFilter functionality processes archive entries with long path headers, specifically affecting the tar.t() and tar.x() methods that accept member-selection lists. The vulnerability stems from the recursive mapHas helper function in src/list.ts which traverses upward through directory paths using path.dirname() without implementing any segment limitations or depth caps during the recursive walk process.
The technical implementation of this vulnerability exploits the absence of boundary checks in path traversal logic, allowing maliciously crafted archive entries with thousands of slash-separated segments to trigger infinite recursion. When a GNU L or PAX x long-path header containing numerous directory levels is processed, the system calls entry.path through the filter function in Parser[CONSUMEHEADER] within src/parse.ts before reaching the maxDepth validation that would normally occur in Unpack[CHECKPATH]. This timing gap creates an exploitable condition where the recursive path resolution continues unchecked until it exhausts the JavaScript engine's call stack, resulting in a RangeError stack overflow that terminates asynchronous and streaming Node.js operations.
The operational impact of this vulnerability extends beyond simple denial of service, as it can completely disrupt Node.js applications relying on tar archive processing. Attackers can craft malicious archives with deeply nested paths to crash applications handling untrusted input, potentially affecting web servers, build systems, and any software components that utilize node-tar for archive extraction or listing operations. The vulnerability affects any version prior to 7.5.21, making it particularly concerning for widely deployed applications that may not have been updated to the patched version.
This issue aligns with CWE-674 - Uncontrolled Recursion and falls under ATT&CK technique T1203 - Exploitation for Client Execution when targeting Node.js applications. The vulnerability demonstrates poor input validation and inadequate recursion depth controls in archive processing libraries, representing a classic example of how seemingly benign path traversal operations can become security threats when proper boundary checks are omitted. The fix implemented in version 7.5.21 addresses this by introducing appropriate segment limits and ensuring that path traversal operations respect maximum depth constraints before allowing recursive processing to continue.
The root cause lies in the improper separation between early-stage header parsing and late-stage path validation, creating a window where maliciously constructed long-path headers can bypass normal safety mechanisms. This architectural flaw highlights the importance of implementing robust input sanitization and boundary checking in file system operations, particularly when dealing with untrusted archive content. The vulnerability serves as a reminder that even well-established libraries require continuous security auditing, especially in areas involving path manipulation and recursive operations where stack overflow conditions can be easily triggered through crafted inputs.