CVE-2026-73566: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-tarto a version that resolves this vulnerability.Fixed in 7.5.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73566?
CVE-2026-73566 has a high severity score of 7.5.
What type of attack does CVE-2026-73566 facilitate?
CVE-2026-73566 can lead to an uncatchable stack-overflow denial of service (DoS) via crafted long-path tar files.
How do I fix CVE-2026-73566?
To fix CVE-2026-73566, upgrade node-tar to version 7.5.21 or later.
What versions of node-tar are affected by CVE-2026-73566?
CVE-2026-73566 affects versions of node-tar prior to 7.5.21.
What is the impact of CVE-2026-73566 on applications using node-tar?
Applications using node-tar with the vulnerable versions may experience denial of service due to uncontrolled recursion.