# CVE-2021-37701: npm tar symlink bypass in directory cache poisoning

Source: https://junglewise.ai/threats/cve-2021-37701-npm-tar-symlink-bypass-in-directory-cache-poisoning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-37701 · Severity: low · CVSS 3.1 · Published 2021-08-31

npm tar is a popular Node.js library for extracting and creating TAR archives. Due to insufficient symlink protection in directory caching, an attacker can craft a malicious TAR file that bypasses security checks and writes arbitrary files to unintended locations on a system when extracted. This could allow attackers to overwrite critical files or inject malicious code into applications that process untrusted archives.

Technologies: [tar (npm)](https://junglewise.ai/threats/technologies/npm-tar). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-37701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-37701 being exploited in the wild.

**How severe is CVE-2021-37701?** Low severity, with a CVSS score of 3.1, published 31 August 2021.

**Which products and versions are affected?** tar (npm) SEMVER:introduced=3.0.0,fixed=4.4.16.

**Is there a fix for CVE-2021-37701?** Yes. tar (npm): upgrade to 4.4.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-37701 attacked?** It is attacked with local access.

**Am I affected by CVE-2021-37701?** Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tar (npm): upgrade to 4.4.16 or later

  ```sh
  npm install tar@4.4.16
  ```


## Technical details

The vulnerability exists in node-tar's directory extraction logic, which caches directories to avoid redundant filesystem stat calls. When extracting a TAR archive containing both a directory and a symlink with the same name (exploiting backslash path separators on POSIX systems or case-insensitivity), an attacker can replace a cached directory with a symlink and bypass symlink security checks. The cache normalization used both forward and backward slashes as path separators, but backslash is a valid filename character on POSIX systems. By creating a directory entry followed by a symlink entry with the same name, the library would treat them as separate entries, allowing subsequent file extraction to follow the symlink to an arbitrary location. Patches were released in versions 4.4.16, 5.0.8, and 6.1.7, which normalize all paths to use forward slashes and perform case-insensitive cache pruning.

## Affected products

- npm tar <4.4.16, 5.0.0-5.0.7, 6.0.0-6.1.6

## Identifiers

- CVE-2021-37701
- GHSA-9r2w-394v-53qc

## Timeline

- 2021-08-31: disclosed
- 2021-08-31: patched: Patches released in versions 4.4.16, 5.0.8, and 6.1.7

## References

- [https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc](https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc)

## Related threats

- [npm tar stack overflow in mapHas filter with long paths](https://junglewise.ai/threats/cve-2026-73566-npm-tar-stack-overflow-in-maphas-filter-with-long-paths)
- [node-tar denial of service via NUL byte in PAX records](https://junglewise.ai/threats/cve-2026-59875-node-tar-denial-of-service-via-nul-byte-in-pax-records)
- [isaacs node-tar infinite loop in tar.replace](https://junglewise.ai/threats/cve-2026-59874-isaacs-node-tar-infinite-loop-in-tar-replace)
- [isaacs node-tar Denial of Service via Gzip Bomb](https://junglewise.ai/threats/cve-2026-59873-isaacs-node-tar-denial-of-service-via-gzip-bomb)
- [isaacs node-tar denial of service via PAX numeric path type confusion](https://junglewise.ai/threats/cve-2026-59871-isaacs-node-tar-denial-of-service-via-pax-numeric-path-type)