tar
7.5.22 · 24 Jul 2026BlueOak-1.0.0117.9M / weekRepositoryHomepagenpmAtom feed
Your version
7.4.4
22 Sep 20257.5.22 is the newest release of 7.x.
npm marks 7.4.4 as deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
Security
12 advisories affect 7.4.4; 7.5.21 fixes them
- Criticalnode-tar: Decompression/parse DoS via unlimited inputGHSA-23hp-3jrh-7fpw · 20 Jul 2026Fixed in 7.5.19
- Highnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionGHSA-r292-9mhp-454m · 24 Jul 2026Fixed in 7.5.21
- Highnode-tar: Negative tar entry size causes infinite loop in archive replaceGHSA-8x88-c5mf-7j5w · 20 Jul 2026Fixed in 7.5.18
- Highnode-tar Symlink Path Traversal via Drive-Relative LinkpathGHSA-9ppj-qmqm-q256 · 10 Mar 2026Fixed in 7.5.11
- Hightar has Hardlink Path Traversal via Drive-Relative LinkpathGHSA-qffp-2rhf-9h96 · 5 Mar 2026Fixed in 7.5.10
7 more
- HighArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar ExtractionGHSA-83g3-92jg-28cx · 18 Feb 2026Fixed in 7.5.8
- Highnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalGHSA-34x7-hfp2-rc4v · 28 Jan 2026Fixed in 7.5.7
- HighRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSGHSA-r6q2-hw4h-h46w · 21 Jan 2026Fixed in 7.5.4
- Highnode-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationGHSA-8qq5-rm4j-mr97 · 16 Jan 2026Fixed in 7.5.3
- Moderatenode-tar: Process crash via PAX numeric path type confusionGHSA-w8wr-v893-vjvp · 20 Jul 2026Fixed in 7.5.18
- Moderatenode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsGHSA-gvwx-54wh-qm9j · 20 Jul 2026Fixed in 7.5.17
- Moderatenode-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)GHSA-vmf3-w455-68vh · 15 Jun 2026Fixed in 7.5.16
Release note
No note was found for 7.4.4 on GitHub or in the repository's changelog.