Bug 2515509 (CVE-2026-73566)

Summary: CVE-2026-73566 tar: node-tar: Denial of Service via crafted long-path tar archive
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anthomas, anujha, aoconnor, aos-team-art-private, aruklets, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, bniver, boliveir, bstansbe, cdrage, dbruscin, dfreiber, dlofthou, dmayorov, doconnor, dpaolell, drichtar, drow, dschmidt, dymurray, eborisov, ehelms, ehugonne, flucifre, fmariani, gbenhaim, ggainey, gmalinko, gmeno, gparvin, groman, gtanzill, ibolton, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jchui, jdelft, jhe, jlanda, jlledo, jmatthew, jmontleo, jpasqual, jprabhak, jupierce, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, lgarciaa, mbenjamin, mbiarnes, mcarlett, mdellweg, mhackett, mhulan, mosmerov, mposolda, mstipich, msvehla, nboldt, ngough, niyer, nmoumoul, nwallace, oaljalju, osousa, pantinor, pberan, pcreech, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, psrna, rchan, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sostapov, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, tcunning, teagle, thjenkin, tmalecek, tsedmik, twaugh, vdosoudi, vereddy, veshanka, vkumar, vlaad, vmuzikar, watson-tool-maintainers, wtam, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the `filesFilter` function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-13 17:51:57 UTC 
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.