tar
7.5.22 · 24 Jul 2026BlueOak-1.0.0117.9M / weekRepositoryHomepagenpmAtom feed
Upgrading tar From 1.0.3 to 7.5.21
128 releases in betweennotes for 2
Other targets from 1.0.3Latest7.5.22
7.0.0, 6.0.0, 5.0.0, 4.0.0, 3.0.0, 2.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
- ?
- changes to make
- 17
- advisories fixed
- ?
- new
- 2+
- fixes
Counted from 2 of 128 release notes. Advisories are counted from the advisory database, in full.
Security
Fixes 17 advisories affecting 1.0.3
- node-tar: Decompression/parse DoS via unlimited inputcritical · GHSA-23hp-3jrh-7fpw
- node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversalhigh · GHSA-34x7-hfp2-rc4v
- Arbitrary File Creation/Overwrite due to insufficient absolute path sanitizationhigh · GHSA-3jfq-g458-7qm9
- Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationhigh · GHSA-5955-9wpr-37jh
- Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extractionhigh · GHSA-83g3-92jg-28cx
- node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitizationhigh · GHSA-8qq5-rm4j-mr97
- node-tar: Negative tar entry size causes infinite loop in archive replacehigh · GHSA-8x88-c5mf-7j5w
- node-tar Symlink Path Traversal via Drive-Relative Linkpathhigh · GHSA-9ppj-qmqm-q256
- Denial of service while parsing a tar file due to lack of folders count validationmoderate · GHSA-f5x3-32g6-xq36
- Symlink Arbitrary File Overwrite in tarhigh · GHSA-gfjr-3jmm-4g9v
- node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsmoderate · GHSA-gvwx-54wh-qm9j
- Arbitrary File Overwrite in tarhigh · GHSA-j44m-qm6p-hp7m
- tar has Hardlink Path Traversal via Drive-Relative Linkpathhigh · GHSA-qffp-2rhf-9h96
- node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionhigh · GHSA-r292-9mhp-454m
- Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFShigh · GHSA-r6q2-hw4h-h46w
- node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)moderate · GHSA-vmf3-w455-68vh
- node-tar: Process crash via PAX numeric path type confusionmoderate · GHSA-w8wr-v893-vjvp
Release by release
6.1.13 – 7.5.2137 releases, nothing new or fixed; 36 without a note
- fixed
Ensuring close event is emited after stream has ended
- fixed
Replace deprecated String.prototype.substr() (#314) (@CommanderRoot, @lukekarrys)
- fixed
2.0.0 – 6.1.1190 releases, no release note
3 internal lines (docs, tests, tooling) left out.