# tar (npm) vulnerabilities 21 known vulnerabilities (1 critical, 13 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.5.22 (Jul 24, 2026): no advisory affects it - Newest unaffected release: 7.5.22 (Jul 24, 2026), the latest release - Weekly downloads: 119.3M - Dependents: 24.3K - Releases: 153 since 0.0.1 (Nov 20, 2011) - Registry: https://www.npmjs.com/package/tar - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-73566: 0.0.1 to 7.5.20 (7.5.21 is outside it) - CVE-2026-59871: 0.0.1 to 7.5.17 (7.5.18 is outside it) - CVE-2026-59874: 0.0.1 to 7.5.17 (7.5.18 is outside it) - CVE-2026-59873: 0.0.1 to 7.5.18 (7.5.19 is outside it) - CVE-2026-59875: 0.0.1 to 7.5.16 (7.5.17 is outside it) - CVE-2026-53655: 0.0.1 to 7.5.15 (7.5.16 is outside it) - CVE-2026-31802: 0.0.1 to 7.5.10 (7.5.11 is outside it) - CVE-2026-29786: 0.0.1 to 7.5.9 (7.5.10 is outside it) - CVE-2026-26960: 0.0.1 to 7.5.7 (7.5.8 is outside it) - CVE-2026-24842: 0.0.1 to 7.5.6 (7.5.7 is outside it) - CVE-2026-23950: 0.0.1 to 7.5.3 (7.5.4 is outside it) - CVE-2026-23745: 0.0.1 to 7.5.2 (7.5.3 is outside it) - CVE-2025-64118: 7.5.1 (7.5.2 is outside it) - CVE-2024-28863: 0.0.1 to 6.2.0 (6.2.1 is outside it) - CVE-2021-37713: 0.0.1 to 4.4.17 (4.4.18 is outside it); 5.0.0 to 5.0.9 (5.0.10 is outside it); 6.0.0 to 6.1.8 (6.1.9 is outside it) - CVE-2021-37712: 3.0.0 to 4.4.17 (4.4.18 is outside it); 5.0.0 to 5.0.9 (5.0.10 is outside it); 6.0.0 to 6.1.8 (6.1.9 is outside it) - CVE-2021-37701: 3.0.0 to 4.4.15 (4.4.16 is outside it); 5.0.0 to 5.0.7 (5.0.8 is outside it); 6.0.0 to 6.1.6 (6.1.7 is outside it) - CVE-2021-32804: 0.0.1 to 3.2.1 (3.2.2 is outside it); 4.0.0 to 4.4.13 (4.4.14 is outside it); 5.0.0 to 5.0.5 (5.0.6 is outside it); 6.0.0 to 6.1.0 (6.1.1 is outside it) - CVE-2021-32803: 3.0.0 to 3.2.2 (3.2.3 is outside it); 4.0.0 to 4.4.14 (4.4.15 is outside it); 5.0.0 to 5.0.6 (5.0.7 is outside it); 6.0.0 to 6.1.1 (6.1.2 is outside it) - CVE-2018-20834: 0.0.1 to 2.2.1 (2.2.2 is outside it); 3.0.0 to 4.4.1 (4.4.2 is outside it) - CVE-2015-8860: 0.0.1 to 1.0.3 (2.0.0 is outside it) ## Advisories (21) ### [CVE-2026-73566](https://cve.now/CVE-2026-73566): node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: fixed in 7.5.21. - Fixed in 7.5.21 (released Jul 21, 2026, 23 days before disclosure). - The latest release, 7.5.22, is not affected. - 56% of tar downloads last week were affected versions (74.8M). ### [CVE-2026-59871](https://cve.now/CVE-2026-59871): node-tar: Process crash via PAX numeric path type confusion - Severity: Medium 5.3 - Published: Jul 8, 2026 - Affected: fixed in 7.5.18. - Fixed in 7.5.18 (released Jun 27, 2026, 11 days before disclosure). - The latest release, 7.5.22, is not affected. - 51% of tar downloads last week were affected versions (69.2M). ### [CVE-2026-59874](https://cve.now/CVE-2026-59874): node-tar: Negative tar entry size causes infinite loop in archive replace - Severity: High 8.7 - Published: Jul 8, 2026 - Affected: fixed in 7.5.18. - Fixed in 7.5.18 (released Jun 27, 2026, 11 days before disclosure). - The latest release, 7.5.22, is not affected. - 51% of tar downloads last week were affected versions (69.2M). ### [CVE-2026-59873](https://cve.now/CVE-2026-59873): node-tar: Decompression/parse DoS via unlimited input - Severity: Critical 9.2 - Published: Jul 8, 2026 - Affected: fixed in 7.5.19. - Fixed in 7.5.19 (released Jun 27, 2026, 11 days before disclosure). - The latest release, 7.5.22, is not affected. - 52% of tar downloads last week were affected versions (69.2M). ### [CVE-2026-59875](https://cve.now/CVE-2026-59875): node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records - Severity: Medium 5.3 - Published: Jul 8, 2026 - Affected: fixed in 7.5.17. - Fixed in 7.5.17 (released Jun 25, 2026, 13 days before disclosure). - The latest release, 7.5.22, is not affected. - 51% of tar downloads last week were affected versions (69M). ### [CVE-2026-53655](https://cve.now/CVE-2026-53655): node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file… - Severity: Medium 6.9 - Published: Jun 22, 2026 - Affected: fixed in 7.5.16. - Fixed in 7.5.16 (released Jun 1, 2026, 21 days before disclosure). - The latest release, 7.5.22, is not affected. - 48% of tar downloads last week were affected versions (64.3M). ### [CVE-2026-31802](https://cve.now/CVE-2026-31802): node-tar Symlink Path Traversal via Drive-Relative Linkpath - Severity: High 8.2 - Published: Mar 9, 2026 - Affected: fixed in 7.5.11. - Fixed in 7.5.11 (released Mar 9, 2026, the day of disclosure). - The latest release, 7.5.22, is not affected. - 41% of tar downloads last week were affected versions (54.6M). ### [CVE-2026-29786](https://cve.now/CVE-2026-29786): node-tar: Hardlink Path Traversal via Drive-Relative Linkpath - Severity: High 8.2 - Published: Mar 7, 2026 - Affected: fixed in 7.5.10. - Fixed in 7.5.10 (released Mar 4, 2026, 3 days before disclosure). - The latest release, 7.5.22, is not affected. - 41% of tar downloads last week were affected versions (54.5M). ### [CVE-2026-26960](https://cve.now/CVE-2026-26960): node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction - Severity: High 7.1 - Published: Feb 20, 2026 - Affected: fixed in 7.5.8. - Fixed in 7.5.8 (released Feb 16, 2026, 4 days before disclosure). - The latest release, 7.5.22, is not affected. - 40% of tar downloads last week were affected versions (53.5M). ### [CVE-2026-24842](https://cve.now/CVE-2026-24842): node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - Severity: High 8.2 - Published: Jan 28, 2026 - Affected: fixed in 7.5.7. - Fixed in 7.5.7 (released Jan 27, 2026, 1 day before disclosure). - The latest release, 7.5.22, is not affected. - 38% of tar downloads last week were affected versions (50.8M). ### [CVE-2026-23950](https://cve.now/CVE-2026-23950): node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS - Severity: High 8.8 - Published: Jan 20, 2026 - Affected: fixed in 7.5.4. - Fixed in 7.5.4 (released Jan 19, 2026, 1 day before disclosure). - The latest release, 7.5.22, is not affected. - 38% of tar downloads last week were affected versions (50.5M). ### [CVE-2026-23745](https://cve.now/CVE-2026-23745): node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - Severity: High 8.2 - Published: Jan 16, 2026 - Affected: fixed in 7.5.3. - Fixed in 7.5.3 (released Jan 16, 2026, the day of disclosure). - The latest release, 7.5.22, is not affected. - 38% of tar downloads last week were affected versions (50.4M). ### [CVE-2025-64118](https://cve.now/CVE-2025-64118): node-tar vulnerable to race condition leading to uninitialized memory exposure - Severity: Medium 6.1 - Published: Oct 30, 2025 - Affected: from 7.5.1, fixed in 7.5.2. - Fixed in 7.5.2 (released Oct 30, 2025, the day of disclosure). - The latest release, 7.5.22, is not affected. - 2.3% of tar downloads last week were affected versions (3.1M). ### [CVE-2024-28863](https://cve.now/CVE-2024-28863): node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation - Severity: Medium 6.5 - Published: Mar 21, 2024 - Affected: fixed in 6.2.1. - Fixed in 6.2.1 (released Mar 21, 2024, the day of disclosure). - The latest release, 7.5.22, is not affected. - 7% of tar downloads last week were affected versions (9.4M). ### [CVE-2021-37713](https://cve.now/CVE-2021-37713): Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization - Severity: High 8.2 - Published: Aug 31, 2021 - Affected: fixed in 4.4.18; from 5.0.0, fixed in 5.0.10; from 6.0.0, fixed in 6.1.9. - Fixed in 4.4.18 (released Aug 19, 2021, 12 days before disclosure), 5.0.10 (released Aug 19, 2021, 12 days before disclosure) and 6.1.9 (released Aug 19, 2021, 12 days before disclosure). - The latest release, 7.5.22, is not affected. - 2.3% of tar downloads last week were affected versions (3.1M). ### [CVE-2021-37712](https://cve.now/CVE-2021-37712): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links - Severity: High 8.2 - Published: Aug 31, 2021 - Affected: from 3.0.0, fixed in 4.4.18; from 5.0.0, fixed in 5.0.10; from 6.0.0, fixed in 6.1.9. - Fixed in 4.4.18 (released Aug 19, 2021, 12 days before disclosure), 5.0.10 (released Aug 19, 2021, 12 days before disclosure) and 6.1.9 (released Aug 19, 2021, 12 days before disclosure). - The latest release, 7.5.22, is not affected. - 1.1% of tar downloads last week were affected versions (1.5M). ### [CVE-2021-37701](https://cve.now/CVE-2021-37701): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links - Severity: High 8.2 - Published: Aug 31, 2021 - Affected: from 3.0.0, fixed in 4.4.16; from 5.0.0, fixed in 5.0.8; from 6.0.0, fixed in 6.1.7. - Fixed in 4.4.16 (released Aug 9, 2021, 22 days before disclosure), 5.0.8 (released Aug 9, 2021, 22 days before disclosure) and 6.1.7 (released Aug 9, 2021, 22 days before disclosure). - The latest release, 7.5.22, is not affected. - 1.1% of tar downloads last week were affected versions (1.5M). ### [CVE-2021-32804](https://cve.now/CVE-2021-32804): Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization - Severity: High 8.2 - Published: Aug 3, 2021 - Affected: fixed in 3.2.2; from 4.0.0, fixed in 4.4.14; from 5.0.0, fixed in 5.0.6; from 6.0.0, fixed in 6.1.1. - Fixed in 3.2.2 (released Jul 23, 2021, 11 days before disclosure), 4.4.14 (released Jul 23, 2021, 11 days before disclosure), 5.0.6 (released Jul 23, 2021, 11 days before disclosure) and 1 other version. - The latest release, 7.5.22, is not affected. - 2.2% of tar downloads last week were affected versions (3M). ### [CVE-2021-32803](https://cve.now/CVE-2021-32803): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning - Severity: High 8.2 - Published: Aug 3, 2021 - Affected: from 3.0.0, fixed in 3.2.3; from 4.0.0, fixed in 4.4.15; from 5.0.0, fixed in 5.0.7; from 6.0.0, fixed in 6.1.2. - Fixed in 3.2.3 (released Jul 26, 2021, 8 days before disclosure), 4.4.15 (released Jul 26, 2021, 8 days before disclosure), 5.0.7 (released Jul 26, 2021, 8 days before disclosure) and 1 other version. - The latest release, 7.5.22, is not affected. - 1.1% of tar downloads last week were affected versions (1.4M). ### [CVE-2018-20834](https://cve.now/CVE-2018-20834): A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). - Severity: Unrated - Published: Apr 30, 2019 - Affected: from 3.0.0, fixed in 4.4.2; fixed in 2.2.2. - Fixed in 2.2.2 (released May 15, 2019, 15 days after disclosure) and 4.4.2 (released Apr 30, 2018, 365 days before disclosure). - The latest release, 7.5.22, is not affected. - 0.3% of tar downloads last week were affected versions (417.1K). ### [CVE-2015-8860](https://cve.now/CVE-2015-8860): The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive. - Severity: Unrated - Published: Jan 23, 2017 - Affected: fixed in 2.0.0. - Fixed in 2.0.0 (released Mar 27, 2015, 668 days before disclosure). - The latest release, 7.5.22, is not affected. - <0.1% of tar downloads last week were affected versions (47.8K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/tar Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.