Bug 2491423 (CVE-2026-53655)

Summary: CVE-2026-53655 node-tar: node-tar: File smuggling due to inconsistent tar archive parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, abrianik, akhatavk, akostadi, alizardo, amasferr, anpicker, anthomas, anujha, aos-team-art-private, aprice, aruklets, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, boliveir, brasmith, bstansbe, cdrage, cmah, cochase, dbosanac, dbruscin, derez, dfreiber, dlofthou, dmayorov, doconnor, dpaolell, dranck, drichtar, drow, dschmidt, dymurray, eaguilar, ebaron, eborisov, ehelms, ehugonne, fmariani, gbenhaim, ggainey, ggrzybek, gmalinko, gparvin, gtanzill, hasun, ibolton, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jchui, jdelft, jfula, jhe, jlanda, jlledo, jmatsuok, jmatthew, jmitchel, jmontleo, jolong, jowilson, jpasqual, jraez, jreimann, jsamir, jtolenti, jupierce, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, lgarciaa, manissin, mbiarnes, mcarlett, mdellweg, mdessi, mhulan, mosmerov, mposolda, mrizzi, mstipich, msvehla, nboldt, ngough, niyer, nmoumoul, nwallace, nyancey, oaljalju, oezr, ometelka, osousa, pantinor, parichar, pberan, pcattana, pcreech, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rchan, rekumar, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, syedriko, tasato, tcunning, teagle, thjenkin, tmalecek, tsedmik, twaugh, vdosoudi, veshanka, vkumar, vlaad, vmuzikar, vvoronko, watson-tool-maintainers, xdharmai, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to other standard tar implementations. A remote attacker could exploit this by crafting a malicious archive, causing different interpretations of archive contents between node-tar and other tools. This could allow an attacker to hide malicious files or sensitive information from security scanners that rely on different tar parsing libraries, potentially leading to information disclosure or bypassing security controls.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2498648, 2498649, 2498650, 2498654, 2498655, 2498657, 2498659, 2498660, 2498662, 2498663, 2498675, 2498676, 2498682, 2498685, 2498686, 2498651, 2498652, 2498653, 2498656, 2498658, 2498661, 2498664, 2498665, 2498666, 2498667, 2498668, 2498669, 2498670, 2498671, 2498672, 2498673, 2498674, 2498677, 2498678, 2498679, 2498680, 2498681, 2498683, 2498684    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-22 16:02:48 UTC 
node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.