AIKIDO-2026-401672
tar is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
tarTL;DR
The PAX header parser in parseKV coerces all-digit path and linkpath values to JavaScript numbers. Downstream path handling then calls .split('/') on that numeric value and throws an uncaught TypeError, which bypasses strict: false and application error/warn handlers. Extracting a crafted archive therefore crashes the Node.js process. The fix keeps string fields such as path and linkpath as strings and casts paths to String in normalizeWindowsPath.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application extracts untrusted tar archives.
Background info
tar is vulnerable to Denial of Service (DoS) in versions 0.0.0 - 7.5.17.
How to fix this
Upgrade the tar library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant