tar
7.5.22 · 24 Jul 2026BlueOak-1.0.0117.9M / weekRepositoryHomepagenpmAtom feed
Your version
7.5.8
16 Feb 20267.5.22 is the newest release of 7.x.
Security
Fixes 1 advisory that affected 7.5.7
- HighArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar ExtractionGHSA-83g3-92jg-28cx · 18 Feb 2026Fixed in 7.5.8
8 advisories affect 7.5.8; 7.5.21 fixes them
- Criticalnode-tar: Decompression/parse DoS via unlimited inputGHSA-23hp-3jrh-7fpw · 20 Jul 2026Fixed in 7.5.19
- Highnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionGHSA-r292-9mhp-454m · 24 Jul 2026Fixed in 7.5.21
- Highnode-tar: Negative tar entry size causes infinite loop in archive replaceGHSA-8x88-c5mf-7j5w · 20 Jul 2026Fixed in 7.5.18
- Highnode-tar Symlink Path Traversal via Drive-Relative LinkpathGHSA-9ppj-qmqm-q256 · 10 Mar 2026Fixed in 7.5.11
- Hightar has Hardlink Path Traversal via Drive-Relative LinkpathGHSA-qffp-2rhf-9h96 · 5 Mar 2026Fixed in 7.5.10
3 more
- Moderatenode-tar: Process crash via PAX numeric path type confusionGHSA-w8wr-v893-vjvp · 20 Jul 2026Fixed in 7.5.18
- Moderatenode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsGHSA-gvwx-54wh-qm9j · 20 Jul 2026Fixed in 7.5.17
- Moderatenode-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)GHSA-vmf3-w455-68vh · 15 Jun 2026Fixed in 7.5.16
Release note
No note was found for 7.5.8 on GitHub or in the repository's changelog.