tar
7.5.22 · 24 Jul 2026BlueOak-1.0.0117.9M / weekRepositoryHomepagenpmAtom feed
Upgrading tar From 2.2.2 to 7.5.22
122 releases in betweennotes for 0
Other targets from 2.2.2Clears its 15 advisories7.5.21
7.0.0, 6.0.0, 5.0.0, 4.0.0, 3.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
- ?
- changes to make
- 15
- advisories fixed
- ?
- new
- ?
- fixes
Counted from 0 of 122 release notes. Advisories are counted from the advisory database, in full.
Security
Fixes 15 advisories affecting 2.2.2
- node-tar: Decompression/parse DoS via unlimited inputcritical · GHSA-23hp-3jrh-7fpw
- node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversalhigh · GHSA-34x7-hfp2-rc4v
- Arbitrary File Creation/Overwrite due to insufficient absolute path sanitizationhigh · GHSA-3jfq-g458-7qm9
- Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationhigh · GHSA-5955-9wpr-37jh
- Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extractionhigh · GHSA-83g3-92jg-28cx
- node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitizationhigh · GHSA-8qq5-rm4j-mr97
- node-tar: Negative tar entry size causes infinite loop in archive replacehigh · GHSA-8x88-c5mf-7j5w
- node-tar Symlink Path Traversal via Drive-Relative Linkpathhigh · GHSA-9ppj-qmqm-q256
- Denial of service while parsing a tar file due to lack of folders count validationmoderate · GHSA-f5x3-32g6-xq36
- node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsmoderate · GHSA-gvwx-54wh-qm9j
- tar has Hardlink Path Traversal via Drive-Relative Linkpathhigh · GHSA-qffp-2rhf-9h96
- node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionhigh · GHSA-r292-9mhp-454m
- Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFShigh · GHSA-r6q2-hw4h-h46w
- node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)moderate · GHSA-vmf3-w455-68vh
- node-tar: Process crash via PAX numeric path type confusionmoderate · GHSA-w8wr-v893-vjvp