--- id: CVE-2026-73566 title: node-tar is a tar archive manipulation library for Node.js summary: >- node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(..… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-400 - CWE-674 - CWE-770 published: '2026-08-13' updated: '2026-09-16' sourceUpdated: '2026-09-16T13:42:43.410' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73566' references: - url: >- https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a label: security-advisories@github.com - url: 'https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m' label: security-advisories@github.com - url: 'https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73566.json - url: 'https://access.redhat.com/security/cve/CVE-2026-73566' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515509' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73566' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73566' - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:65155' - url: 'https://access.redhat.com/errata/RHSA-2026:66003' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://access.redhat.com/errata/RHSA-2026:60446' - url: 'https://access.redhat.com/errata/RHSA-2026:63046' - url: 'https://access.redhat.com/errata/RHSA-2026:60441' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' tags: - nvd - csaf - vex - red-hat epss: 0.00527 epssPercentile: 0.42164 ingestedAt: '2026-09-16T13:56:12.588Z' vendor: Red Hat product: Red Hat OpenShift Dev Spaces 3.30 affected: - exploit_intelligence - migration_toolkit_for_applications 8 - node_healthcheck_operator - openshift_pipelines - advanced_cluster_management_for_kubernetes 2 - build_of_podman_desktop - ceph_storage 4 - connectivity_link 1 - developer_hub - enterprise_linux 10 - enterprise_linux 8 - enterprise_linux 9 - enterprise_linux_ai_rhel_ai 3 - jboss_enterprise_application_platform 7 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_dev_spaces - openshift_gitops - single_sign_on 7 - trusted_artifact_signer - secrets_management_console_for_red_hat_openshift - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - migration_toolkit 1.8 - openshift_ai 2.25 - openshift_container_platform 4.20 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_dev_spaces 3.30 patched: - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - migration_toolkit 1.8 - openshift_ai 2.25 - openshift_container_platform 4.20 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_dev_spaces 3.30 --- ## Overview node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:65155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65155) - **RHSA-2026:66003** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66003) - **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **RHSA-2026:60446** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60446) - **RHSA-2026:63046** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:63046) - **RHSA-2026:60441** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60441) - **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260) - **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Node HealthCheck Operator, OpenShift Pipelines, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Podman Desktop, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat JBoss Enterprise Application Platform 7, Secrets Management Console for Red Hat OpenShift, Exploit Intelligence, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73566.json)