tar
7.5.22 · 24 Jul 2026BlueOak-1.0.0117.9M / weekRepositoryHomepagenpmAtom feed
Upgrading tar From 3.2.3 to 7.5.22
100 releases in betweennotes for 0
Other targets from 3.2.3Clears its 17 advisories7.5.21
7.0.0, 6.0.0, 5.0.0, 4.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
- ?
- changes to make
- 17
- advisories fixed
- ?
- new
- ?
- fixes
Counted from 0 of 100 release notes. Advisories are counted from the advisory database, in full.
Security
Fixes 17 advisories affecting 3.2.3
- node-tar: Decompression/parse DoS via unlimited inputcritical · GHSA-23hp-3jrh-7fpw
- node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversalhigh · GHSA-34x7-hfp2-rc4v
- Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationhigh · GHSA-5955-9wpr-37jh
- Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extractionhigh · GHSA-83g3-92jg-28cx
- node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitizationhigh · GHSA-8qq5-rm4j-mr97
- node-tar: Negative tar entry size causes infinite loop in archive replacehigh · GHSA-8x88-c5mf-7j5w
- node-tar Symlink Path Traversal via Drive-Relative Linkpathhigh · GHSA-9ppj-qmqm-q256
- Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linkshigh · GHSA-9r2w-394v-53qc
- Denial of service while parsing a tar file due to lack of folders count validationmoderate · GHSA-f5x3-32g6-xq36
- node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsmoderate · GHSA-gvwx-54wh-qm9j
- Arbitrary File Overwrite in tarhigh · GHSA-j44m-qm6p-hp7m
- tar has Hardlink Path Traversal via Drive-Relative Linkpathhigh · GHSA-qffp-2rhf-9h96
- Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linkshigh · GHSA-qq89-hq3f-393p
- node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionhigh · GHSA-r292-9mhp-454m
- Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFShigh · GHSA-r6q2-hw4h-h46w
- node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)moderate · GHSA-vmf3-w455-68vh
- node-tar: Process crash via PAX numeric path type confusionmoderate · GHSA-w8wr-v893-vjvp