CVE-2026-73566

What it actually does

A crafted GNU L or PAX long-path header with thousands of slash-separated segments triggers unbounded recursive calls in filesFilter via path.dirname() in list.ts before maxDepth checks occur in unpack logic, producing an uncatchable RangeError stack overflow that terminates Node.js asynchronous and streaming consumers.

Why it matters to the business

Disruption of Node.js-based services in Red Hat automation, OpenShift, and AI platform components can cause operational outages and require emergency restarts or rollbacks, especially given the broad downstream prevalence across Red Hat ecosystems.

How an attack unfolds

An attacker crafts a tar archive containing an excessively long path in a GNU long-link or PAX extended header, supplies it to any tar.t() or tar.x() call that accepts a member-selection list, and triggers the recursive mapHas walk that overflows the stack before path validation completes.

How to fix it

Upgrade node-tar to 7.5.21 or later. For the listed Red Hat products apply the corresponding fixed images: platform/automation-portal:1788783591, portal-rhel9:1788943531, ui-rhel9:1788351578, dashboard-rhel9:1788312226, registry-rhel9:1788312157, or py312-rhel9:1787801527 under RHSA-2026:63046.

How to confirm the fix worked

Confirm node-tar version 7.5.21 or newer is present in affected containers or packages, then test that tar operations with long-path archives no longer produce RangeError termination and that maxDepth enforcement occurs before filter evaluation.

Typical attack path

1. Identify an application or service that consumes tar archives using vulnerable node-tar versions via tar.t() or tar.x() with a non-empty filter list.
2. Generate a malicious archive embedding a GNU L or PAX extended header with thousands of path segments.
3. Deliver the archive to the target through any input channel that reaches the vulnerable Parser and list logic.
4. Observe termination of the Node.js process due to the uncatchable RangeError.

How to detect it

Monitor application and container logs for unhandled RangeError stack traces originating from node-tar list.ts or parse.ts during tar extraction or listing operations; correlate with inbound tar files containing unusually long path headers.

What your security team should do

• Immediately apply the RHSA-2026:63046 updates to all listed Red Hat components within the CISA remediation window.
• Inventory all Node.js applications that depend on node-tar and enforce version pinning to 7.5.21+.
• Add tar archive size and path-segment limits at the application layer as defense-in-depth until patches are deployed.