Executive brief
A vulnerability in the node-tar library, a popular tool for handling compressed archives in Node.js, allows a small, specially crafted file to crash any application that attempts to extract it. This can lead to a complete service outage for tools like npm, CI/CD pipelines, and file upload services. The crash is difficult to prevent because it bypasses standard error-handling mechanisms.
Technical details
The vulnerability is an incorrect type conversion (CWE-704) in the PAX header parser within `pax.ts`. The `parseKV` function uses a regular expression `/^[0-9]+$/` to identify numeric values and coerces them to JavaScript numbers using the unary plus operator. When a PAX header contains an all-digit `path` or `linkpath`, the resulting numeric value is passed to `Unpack.CHECKPATH`, which calls `.split('/')`. Because numbers do not possess the `.split` method, a synchronous `TypeError` is thrown. This error propagates as an `uncaughtException`, bypassing standard `'error'` or `'warn'` event handlers and the `strict: false` configuration. The issue is patched in version 7.5.18.
Affected products
- isaacs (node-tar) tar <= 7.5.17
Timeline
- 2026-06-27: disclosed
- 2026-06-27: patched: Fixed in version 7.5.18
- 2026-07-20: advisory