{"id":"CVE-2026-73566","title":"node-tar is a tar archive manipulation library for Node.js","summary":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(..…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-674","CWE-770"],"published":"2026-08-13","updated":"2026-09-16","sourceUpdated":"2026-09-16T13:42:43.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","references":[{"url":"https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","label":"security-advisories@github.com"},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","label":"security-advisories@github.com"},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73566.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-73566"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515509"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73566"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566"},{"url":"https://access.redhat.com/errata/RHSA-2026:65118"},{"url":"https://access.redhat.com/errata/RHSA-2026:65155"},{"url":"https://access.redhat.com/errata/RHSA-2026:66003"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:60446"},{"url":"https://access.redhat.com/errata/RHSA-2026:63046"},{"url":"https://access.redhat.com/errata/RHSA-2026:60441"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00527,"epssPercentile":0.42164,"ingestedAt":"2026-09-16T13:56:12.588Z","vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces 3.30","affected":["exploit_intelligence","migration_toolkit_for_applications 8","node_healthcheck_operator","openshift_pipelines","advanced_cluster_management_for_kubernetes 2","build_of_podman_desktop","ceph_storage 4","connectivity_link 1","developer_hub","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","jboss_enterprise_application_platform 7","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_gitops","single_sign_on 7","trusted_artifact_signer","secrets_management_console_for_red_hat_openshift","ansible_automation_platform 2.1","ansible_automation_platform 2.2","migration_toolkit 1.8","openshift_ai 2.25","openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22","openshift_dev_spaces 3.30"],"patched":["ansible_automation_platform 2.1","ansible_automation_platform 2.2","migration_toolkit 1.8","openshift_ai 2.25","openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22","openshift_dev_spaces 3.30"],"slug":"CVE-2026-73566","body":"## Overview\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118)\n- **RHSA-2026:65155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65155)\n- **RHSA-2026:66003** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66003)\n- **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:60446** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60446)\n- **RHSA-2026:63046** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:63046)\n- **RHSA-2026:60441** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60441)\n- **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260)\n- **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Node HealthCheck Operator, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Podman Desktop, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat JBoss Enterprise Application Platform 7, Secrets Management Console for Red Hat OpenShift, Exploit Intelligence, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73566.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}