GHSA-vmf3-w455-68vh
NoneCVSS
—
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tar | 0 | 7.5.16 |
Related vulnerabilities
- CVE-2026-53655 node-tar is a full-featured Tar for Node.js. Same vulnerability
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects tar
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-26960 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-83g3-92jg-28cx Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar… Also affects tar
- GHSA-34x7-hfp2-rc4v node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal Also affects tar