--- title: "tar security advisories" description: "21 known security advisories for tar, with the versions they affect and the version that fixes each." url: https://inlinr.com/packages/tar/security lang: en --- [Packages](https://inlinr.com/packages) # tar 7.5.22 · 24 Jul 2026 BlueOak-1.0.0 117.9M / week [Repository](https://github.com/isaacs/node-tar) [Homepage](https://github.com/isaacs/node-tar#readme) [npm](https://www.npmjs.com/package/tar) [Atom feed](https://inlinr.com/packages/feed/tar) Your version ## Security advisories From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one. | Line | Newest | Where it stands | | ---- | ------ | ------------------------------------------------------------------------------- | | | 7.5.22 | Safe from 7.5.21 | | | 6.2.1 | 121 open advisories, worst critical · last release Mar 2024, no longer updated | - Critical [node-tar: Decompression/parse DoS via unlimited input](https://inlinr.com/advisories/GHSA-23hp-3jrh-7fpw)GHSA-23hp-3jrh-7fpw · 20 Jul 2026 fixed in 7.5.19 - High [node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection](https://inlinr.com/advisories/GHSA-r292-9mhp-454m)GHSA-r292-9mhp-454m · 24 Jul 2026 fixed in 7.5.21 - High [node-tar: Negative tar entry size causes infinite loop in archive replace](https://inlinr.com/advisories/GHSA-8x88-c5mf-7j5w)GHSA-8x88-c5mf-7j5w · 20 Jul 2026 fixed in 7.5.18 - High [node-tar Symlink Path Traversal via Drive-Relative Linkpath](https://inlinr.com/advisories/GHSA-9ppj-qmqm-q256)GHSA-9ppj-qmqm-q256 · 10 Mar 2026 fixed in 7.5.11 - High [tar has Hardlink Path Traversal via Drive-Relative Linkpath](https://inlinr.com/advisories/GHSA-qffp-2rhf-9h96)GHSA-qffp-2rhf-9h96 · 5 Mar 2026 fixed in 7.5.10 - High [Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction](https://inlinr.com/advisories/GHSA-83g3-92jg-28cx)GHSA-83g3-92jg-28cx · 18 Feb 2026 fixed in 7.5.8 - High [node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal](https://inlinr.com/advisories/GHSA-34x7-hfp2-rc4v)GHSA-34x7-hfp2-rc4v · 28 Jan 2026 fixed in 7.5.7 - High [Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS](https://inlinr.com/advisories/GHSA-r6q2-hw4h-h46w)GHSA-r6q2-hw4h-h46w · 21 Jan 2026 fixed in 7.5.4 - High [node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization](https://inlinr.com/advisories/GHSA-8qq5-rm4j-mr97)GHSA-8qq5-rm4j-mr97 · 16 Jan 2026 fixed in 7.5.3 - High [Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links](https://inlinr.com/advisories/GHSA-9r2w-394v-53qc)GHSA-9r2w-394v-53qc · 31 Aug 2021 fixed in 6.1.7, 5.0.8, 4.4.16 - High [Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links](https://inlinr.com/advisories/GHSA-qq89-hq3f-393p)GHSA-qq89-hq3f-393p · 31 Aug 2021 fixed in 6.1.9, 5.0.10, 4.4.18 - High [Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization](https://inlinr.com/advisories/GHSA-5955-9wpr-37jh)GHSA-5955-9wpr-37jh · 31 Aug 2021 fixed in 6.1.9, 5.0.10, 4.4.18 - High [Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization](https://inlinr.com/advisories/GHSA-3jfq-g458-7qm9)GHSA-3jfq-g458-7qm9 · 3 Aug 2021 fixed in 6.1.1, 5.0.6, 4.4.14 +1 - High [Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning](https://inlinr.com/advisories/GHSA-r628-mhmh-qjhw)GHSA-r628-mhmh-qjhw · 3 Aug 2021 fixed in 6.1.2, 5.0.7, 4.4.15 +1 - High [Arbitrary File Overwrite in tar](https://inlinr.com/advisories/GHSA-j44m-qm6p-hp7m)GHSA-j44m-qm6p-hp7m · 1 May 2019 fixed in 4.4.2, 2.2.2 - High [Symlink Arbitrary File Overwrite in tar](https://inlinr.com/advisories/GHSA-gfjr-3jmm-4g9v)GHSA-gfjr-3jmm-4g9v · 24 Oct 2017 - Moderate [node-tar: Process crash via PAX numeric path type confusion](https://inlinr.com/advisories/GHSA-w8wr-v893-vjvp)GHSA-w8wr-v893-vjvp · 20 Jul 2026 fixed in 7.5.18 - Moderate [node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records](https://inlinr.com/advisories/GHSA-gvwx-54wh-qm9j)GHSA-gvwx-54wh-qm9j · 20 Jul 2026 fixed in 7.5.17 - Moderate [node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)](https://inlinr.com/advisories/GHSA-vmf3-w455-68vh)GHSA-vmf3-w455-68vh · 15 Jun 2026 fixed in 7.5.16 - Moderate [node-tar has a race condition leading to uninitialized memory exposure](https://inlinr.com/advisories/GHSA-29xp-372q-xqph)GHSA-29xp-372q-xqph · 30 Oct 2025 fixed in 7.5.2 - Moderate [Denial of service while parsing a tar file due to lack of folders count validation](https://inlinr.com/advisories/GHSA-f5x3-32g6-xq36)GHSA-f5x3-32g6-xq36 · 22 Mar 2024 fixed in 6.2.1 ### Quality and security signals What [npm](https://www.npmjs.com/package/tar) and [deps.dev](https://deps.dev/npm/tar) say about the latest release. Signals, not a verdict. Reading npm and deps.dev… Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.