Is tar 3.0 vulnerable?
npm · 2 releases from 3.0.0 to 3.0.1 · latest tar is 7.5.22 · checked 2 Nov 2026
Yes: 19 known advisories
Yes. tar 3.0.1, the last 3.0 release, is affected by 19 known security advisories (1 critical, 14 high, 4 medium), including CVE-2026-59873, CVE-2026-73566, CVE-2026-59874. Upgrade to 7.5.21 or later to fix all of them.
npm install tar@7.5.21Advisories affecting tar 3.0.1
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
- Affected
- <7.5.21
- Fixed in
- 7.5.21
node-tar: Process crash via PAX numeric path type confusion
- Affected
- <7.5.18
- Fixed in
- 7.5.18
node-tar: Decompression/parse DoS via unlimited input
- Affected
- <7.5.19
- Fixed in
- 7.5.19
node-tar: Negative tar entry size causes infinite loop in archive replace
- Affected
- <7.5.18
- Fixed in
- 7.5.18
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
- Affected
- <7.5.17
- Fixed in
- 7.5.17
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
- Affected
- <7.5.16
- Fixed in
- 7.5.16
node-tar Symlink Path Traversal via Drive-Relative Linkpath
- Affected
- <7.5.11
- Fixed in
- 7.5.11
tar has Hardlink Path Traversal via Drive-Relative Linkpath
- Affected
- <7.5.10
- Fixed in
- 7.5.10
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
- Affected
- <7.5.8
- Fixed in
- 7.5.8
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
- Affected
- <7.5.7
- Fixed in
- 7.5.7
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
- Affected
- <7.5.4
- Fixed in
- 7.5.4
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
- Affected
- <7.5.3
- Fixed in
- 7.5.3
Denial of service while parsing a tar file due to lack of folders count validation
- Affected
- <6.2.1
- Fixed in
- 6.2.1
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
- Affected
- >=3.0.0 <4.4.16 · >=5.0.0 <5.0.8 · >=6.0.0 <6.1.7
- Fixed in
- 4.4.16, 5.0.8, 6.1.7
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
- Affected
- >=3.0.0 <4.4.18 · >=5.0.0 <5.0.10 · >=6.0.0 <6.1.9
- Fixed in
- 4.4.18, 5.0.10, 6.1.9
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
- Affected
- <4.4.18 · >=5.0.0 <5.0.10 · >=6.0.0 <6.1.9
- Fixed in
- 4.4.18, 5.0.10, 6.1.9
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
- Affected
- <3.2.2 · >=4.0.0 <4.4.14 · >=5.0.0 <5.0.6 · >=6.0.0 <6.1.1
- Fixed in
- 3.2.2, 4.4.14, 5.0.6, 6.1.1
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
- Affected
- >=3.0.0 <3.2.3 · >=4.0.0 <4.4.15 · >=5.0.0 <5.0.7 · >=6.0.0 <6.1.2
- Fixed in
- 3.2.3, 4.4.15, 5.0.7, 6.1.2
Arbitrary File Overwrite in tar
- Affected
- >=3.0.0 <4.4.2 · <2.2.2
- Fixed in
- 2.2.2, 4.4.2
Which of your client projects are still on tar 3.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact tar version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other tar versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.