Kayiz-Pt

The library fails to strip NUL bytes from PAX path and linkpath records in the `src/pax.ts` file. This allows a specially crafted archive to pass these values to `fs.lstat` or `fs.open`, resulting in an uncaught exception that terminates the process.

The `parse()` function finalizes parsed tokens using `Array.prototype.concat` as a reduce accumulator, which causes the entire growing array to be reallocated and copied during every iteration. This results in quadratic time complexity relative to the number of input tokens. An attacker providing a controlled string to any code path that calls `parse()` can block the single-threaded Node.js event loop for an extended period, leading to a denial of service. This issue affects availability and does not allow for code execution or data disclosure.