{"id":"DEBIAN-CVE-2026-73566","details":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","modified":"2026-09-17T08:47:31.237768590Z","published":"2026-08-13T18:18:19.250Z","upstream":["CVE-2026-73566"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-73566"}],"affected":[{"package":{"name":"node-tar","ecosystem":"Debian:12","purl":"pkg:deb/debian/node-tar?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.13+~cs7.0.5-1","6.1.13+~cs7.0.5-1+deb12u1","6.1.13+~cs7.0.5-2","6.1.13+~cs7.0.5-3","6.1.13+~cs7.0.5-4","6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-10","6.2.1+ds1+~cs6.1.13-11","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-8","6.2.1+ds1+~cs6.1.13-9","6.2.1+~cs7.0.8-1","7.5.16+~4.0.1-1","7.5.16+~4.0.1-2","7.5.19+~4.0.1-1","7.5.19+~4.0.1-2","7.5.22+~4.0.1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73566.json"}},{"package":{"name":"node-tar","ecosystem":"Debian:13","purl":"pkg:deb/debian/node-tar?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-10","6.2.1+ds1+~cs6.1.13-11","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-8","6.2.1+ds1+~cs6.1.13-9","6.2.1+~cs7.0.8-1","6.2.1+~cs7.0.8-1+deb13u1","7.5.16+~4.0.1-1","7.5.16+~4.0.1-2","7.5.19+~4.0.1-1","7.5.19+~4.0.1-2","7.5.22+~4.0.1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73566.json"}},{"package":{"name":"node-tar","ecosystem":"Debian:14","purl":"pkg:deb/debian/node-tar?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.22+~4.0.1-1"}]}],"versions":["6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-10","6.2.1+ds1+~cs6.1.13-11","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-8","6.2.1+ds1+~cs6.1.13-9","6.2.1+~cs7.0.8-1","7.5.16+~4.0.1-1","7.5.16+~4.0.1-2","7.5.19+~4.0.1-1","7.5.19+~4.0.1-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73566.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}