Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T18:18:19.250Z",
  "pubdate": "2026-08-13T18:18:19.250Z",
  "executiveSummary": "An uncatchable RangeError stack overflow vulnerability exists in node-tar prior to version 7.5.21.\nThe flaw allows an attacker to cause a denial of service (DoS) by terminating asynchronous and streaming Node.js consumer applications.\nThe vulnerability is triggered when tar.t(...) or tar.x(...) processes a crafted archive containing a long-path header with thousands of slash-separated segments.\nThis occurs because the filesFilter implementation recursively walks the archive entry path upward using path.dirname() without a segment cap before depth checks are applied.\nAttackers can exploit this by supplying a crafted GNU L or PAX x long-path header within a malicious tar archive.\nNo authentication or specific privileges are required, provided the application processes untrusted tar archives.",
  "technicalDetails": "The root cause of the vulnerability resides in src/list.ts within the filesFilter function, which utilizes the recursive mapHas helper to walk archive entry paths upward via path.dirname().\nWhen tar.t(...) or tar.x(...) receives a non-empty member-selection list, this path-walking mechanism operates without any segment cap or depth limitation.\nExploitation occurs during the parsing phase in Parser[CONSUMEHEADER] located in src/parse.ts.\nA crafted GNU L or PAX x long-path header containing thousands of slash-separated segments forces filesFilter to process the path via this.filter(entry.path, entry).\nThis excessive recursion happens before Unpack[CHECKPATH] can apply the maxDepth constraint.\nThe consequence of this unchecked recursive traversal is an uncatchable RangeError stack overflow that immediately crashes and terminates the Node.js process hosting the asynchronous or streaming consumer.\nThe affected component is the path-filtering and header-parsing mechanism in node-tar versions prior to 7.5.21."
}