tar
7.5.22 · 24 Jul 2026BlueOak-1.0.0117.9M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 7.5.22 | Safe from 7.5.21 | |
| 6.2.1 | 121 open advisories, worst critical · last release Mar 2024, no longer updated |
- Criticalnode-tar: Decompression/parse DoS via unlimited inputGHSA-23hp-3jrh-7fpw · 20 Jul 2026fixed in 7.5.19
- Highnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionGHSA-r292-9mhp-454m · 24 Jul 2026fixed in 7.5.21
- Highnode-tar: Negative tar entry size causes infinite loop in archive replaceGHSA-8x88-c5mf-7j5w · 20 Jul 2026fixed in 7.5.18
- Highnode-tar Symlink Path Traversal via Drive-Relative LinkpathGHSA-9ppj-qmqm-q256 · 10 Mar 2026fixed in 7.5.11
- Hightar has Hardlink Path Traversal via Drive-Relative LinkpathGHSA-qffp-2rhf-9h96 · 5 Mar 2026fixed in 7.5.10
- HighArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar ExtractionGHSA-83g3-92jg-28cx · 18 Feb 2026fixed in 7.5.8
- Highnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalGHSA-34x7-hfp2-rc4v · 28 Jan 2026fixed in 7.5.7
- HighRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSGHSA-r6q2-hw4h-h46w · 21 Jan 2026fixed in 7.5.4
- Highnode-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationGHSA-8qq5-rm4j-mr97 · 16 Jan 2026fixed in 7.5.3
- HighArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksGHSA-9r2w-394v-53qc · 31 Aug 2021fixed in 6.1.7, 5.0.8, 4.4.16
- HighArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksGHSA-qq89-hq3f-393p · 31 Aug 2021fixed in 6.1.9, 5.0.10, 4.4.18
- HighArbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationGHSA-5955-9wpr-37jh · 31 Aug 2021fixed in 6.1.9, 5.0.10, 4.4.18
- HighArbitrary File Creation/Overwrite due to insufficient absolute path sanitizationGHSA-3jfq-g458-7qm9 · 3 Aug 2021fixed in 6.1.1, 5.0.6, 4.4.14 +1
- HighArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoningGHSA-r628-mhmh-qjhw · 3 Aug 2021fixed in 6.1.2, 5.0.7, 4.4.15 +1
- HighArbitrary File Overwrite in tarGHSA-j44m-qm6p-hp7m · 1 May 2019fixed in 4.4.2, 2.2.2
- HighSymlink Arbitrary File Overwrite in tarGHSA-gfjr-3jmm-4g9v · 24 Oct 2017
- Moderatenode-tar: Process crash via PAX numeric path type confusionGHSA-w8wr-v893-vjvp · 20 Jul 2026fixed in 7.5.18
- Moderatenode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsGHSA-gvwx-54wh-qm9j · 20 Jul 2026fixed in 7.5.17
- Moderatenode-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)GHSA-vmf3-w455-68vh · 15 Jun 2026fixed in 7.5.16
- Moderatenode-tar has a race condition leading to uninitialized memory exposureGHSA-29xp-372q-xqph · 30 Oct 2025fixed in 7.5.2
- ModerateDenial of service while parsing a tar file due to lack of folders count validationGHSA-f5x3-32g6-xq36 · 22 Mar 2024fixed in 6.2.1
Registry facts last checked 4 Nov 2026. Releases and advisories last read 4 Nov 2026.