Executive brief
A vulnerability in the node-tar library, which is widely used to extract compressed archive files, allows an attacker to crash the application by providing a specially crafted tarball. This occurs because the library fails to handle certain hidden characters (NUL bytes) in file paths, leading to an unrecoverable error that bypasses standard error-handling code. This can result in a denial-of-service, causing automated build pipelines, backup services, or web applications to stop functioning.
Technical details
The node-tar library fails to sanitize NUL bytes in PAX ('x' typeflag) extended headers for 'path' and 'linkpath' records in `src/pax.ts`. When these unsanitized strings are passed to Node.js core file system functions like `fs.lstat()` or `fs.open()`, Node.js throws an `ERR_INVALID_ARG_VALUE` exception. Because this throw occurs within an internal async callback chain, it surfaces as an `uncaughtException` that terminates the process, bypassing user-level `try/catch` or `await` error handling. Additionally, this creates a parser differential (CWE-436) where other tools like GNU tar truncate at the NUL byte while node-tar retains the full string, potentially bypassing security validators. The issue is fixed in version 7.5.17.
Affected products
- isaacs (node-tar) tar <= 7.5.16
Timeline
- 2026-06-23: disclosed: Vulnerability verified against version 7.5.16
- 2026-06-25: advisory: GitHub Advisory published
- 2026-07-20: advisory: CVE published