Executive brief
A vulnerability in the node-tar library, used for handling tar archives in Node.js applications, can allow an attacker to crash a service. By providing a specially crafted archive with an extremely long file path, an attacker can trigger a system error that shuts down the application. This affects services that process untrusted uploads or restore backups, potentially leading to a complete service outage.
Technical details
An uncontrolled recursion vulnerability exists in the internal `mapHas` helper used by `filesFilter` in node-tar. When a consumer uses member selection (e.g., `tar.t` or `tar.x` with a list of files), the library installs a filter that recursively walks the entry path using `path.dirname()`. An attacker can craft a tar archive with a GNU or PAX long-path header containing thousands of path segments. This causes a stack overflow (`RangeError`), which, in asynchronous or streaming contexts, escapes standard try/catch blocks and terminates the Node.js process. The vulnerability is present because the recursion depth is not capped and the filter is invoked outside of the primary error-handling blocks.
Affected products
- isaacs (node-tar) tar <= 7.5.20
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in version 7.5.21
- 2026-07-24: advisory