tar vulnerabilities

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

Affected

<7.5.21

Fixed in

7.5.21

node-tar: Process crash via PAX numeric path type confusion

Affected

<7.5.18

Fixed in

7.5.18

node-tar: Decompression/parse DoS via unlimited input

Affected

<7.5.19

Fixed in

7.5.19

node-tar: Negative tar entry size causes infinite loop in archive replace

Affected

<7.5.18

Fixed in

7.5.18

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Affected

<7.5.17

Fixed in

7.5.17

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

Affected

<7.5.16

Fixed in

7.5.16

node-tar Symlink Path Traversal via Drive-Relative Linkpath

Affected

<7.5.11

Fixed in

7.5.11

tar has Hardlink Path Traversal via Drive-Relative Linkpath

Affected

<7.5.10

Fixed in

7.5.10

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

Affected

<7.5.8

Fixed in

7.5.8

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Affected

<7.5.7

Fixed in

7.5.7

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

Affected

<7.5.4

Fixed in

7.5.4

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Affected

<7.5.3

Fixed in

7.5.3

node-tar has a race condition leading to uninitialized memory exposure

Affected

>=7.5.1 <7.5.2

Fixed in

7.5.2

Denial of service while parsing a tar file due to lack of folders count validation

Affected

<6.2.1

Fixed in

6.2.1

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Affected

>=3.0.0 <4.4.16 · >=5.0.0 <5.0.8 · >=6.0.0 <6.1.7

Fixed in

4.4.16, 5.0.8, 6.1.7

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Affected

>=3.0.0 <4.4.18 · >=5.0.0 <5.0.10 · >=6.0.0 <6.1.9

Fixed in

4.4.18, 5.0.10, 6.1.9

Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

Affected

<4.4.18 · >=5.0.0 <5.0.10 · >=6.0.0 <6.1.9

Fixed in

4.4.18, 5.0.10, 6.1.9

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Affected

<3.2.2 · >=4.0.0 <4.4.14 · >=5.0.0 <5.0.6 · >=6.0.0 <6.1.1

Fixed in

3.2.2, 4.4.14, 5.0.6, 6.1.1

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

Affected

>=3.0.0 <3.2.3 · >=4.0.0 <4.4.15 · >=5.0.0 <5.0.7 · >=6.0.0 <6.1.2

Fixed in

3.2.3, 4.4.15, 5.0.7, 6.1.2

Arbitrary File Overwrite in tar

Affected

>=3.0.0 <4.4.2 · <2.2.2

Fixed in

2.2.2, 4.4.2

Symlink Arbitrary File Overwrite in tar

Affected

<2.0.0

Fixed in

2.0.0