CVE-2026-73566
Received Received - Intake

Stack Overflow in Node.js tar Library via Malicious Long Path

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73566
EUVD
EUVD-2026-58181

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
isaacs node-tar to 7.5.21 (exc)
node-tar node-tar 7.5.21

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73566 is a high-severity vulnerability in node-tar, a Node.js library for handling tar archives. It allows a denial of service via stack overflow when processing malicious tar files with extremely long path headers containing thousands of segments. The issue occurs in the filesFilter function which uses the mapHas helper to recursively check path segments without a depth limit.

Detection Guidance

To detect this vulnerability, monitor for crashes in Node.js applications using node-tar versions <= 7.5.20 when processing tar archives. Check for stack overflow errors in logs. Use commands like 'npm ls tar' to verify installed versions. Test with crafted malicious tar files containing long paths to observe crashes.

Impact Analysis

This vulnerability can crash Node.js applications that process untrusted tar files, especially those using async or streaming operations. Attackers can send a small malicious tar file (~188 bytes gzipped) to trigger a stack overflow, causing the Node.js process to terminate. Services like package registries or CI systems are particularly vulnerable.

Mitigation Strategies

Upgrade node-tar to version 7.5.21 or later immediately. If upgrading is not possible, implement input validation to reject tar files with excessively long paths. Add depth limits in path processing logic. Monitor for crashes and isolate affected services until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73566. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart