node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5 Patch
- https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w Exploit, Vendor Advisory
- https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · isaacsNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*
References 4
- https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5 Patch
- https://github.com/isaacs/node-tar/releases/tag/v7.5.18 Release Notes
- https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w Exploit, Vendor Advisory
- https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w Exploit, Vendor Advisory