CVE-2026-73566

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.21

Description The filesFilter in src/list.ts uses a recursive mapHas helper to traverse archive entry paths upward using path.dirname() without a segment limit when tar.t(...) or tar.x(...) is called with a non-empty member-selection list. A specially crafted GNU L or PAX x long-path header containing thousands of slash-separated segments can trigger this process in Parser[CONSUMEHEADER] within src/parse.ts before Unpack[CHECKPATH] applies the maxDepth limit. This results in an uncatchable RangeError stack overflow, which terminates asynchronous and streaming Node.js consumers.

Recommendations Update to version 7.5.21.