CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
Attackers can cause uncatchable stack overflow and application crash in Node.js applications using node-tar by providing crafted tar archives with long paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73566?
CVE-2026-73566 is a high-severity denial of service vulnerability in isaacs node-tar, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
Which versions are affected by CVE-2026-73566?
2 open source packages ship an affected version, including tar.
| Package | Affected | Fixed in |
|---|---|---|
tar npm | All versions | 7.5.21 |
tar npm | All versions | 7.5.21 |
How do I fix CVE-2026-73566?
Upgrade tar to 7.5.21 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-73566 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73566 exists.
Sources
Also known as CLEANSTART-2026-ED22669, CLEANSTART-2026-EG50639, CLEANSTART-2026-FT30855, CLSA-2026-1784856442, DEBIAN-CVE-2026-73566, ECHO-8eb3-d0ef-aa59 and 37 more.