CVE-2026-73566 isaacs CVE debrief

Who should care

Node.js developers and maintainers using the node-tar library, especially those processing tar archives from untrusted sources, should assess exposure and upgrade to version 7.5.21 or later.

Why it matters

CVE-2026-73566 is a high-severity vulnerability in node-tar that can cause a RangeError stack overflow, potentially disrupting data processing and impacting Node.js applications. Developers and maintainers should assess exposure, prioritize upgrading to version 7.5.21 or later, and implement input validation and sanitization for tar archive entries.

• Potential denial-of-service (DoS) due to stack overflow
• Possible data processing disruption for Node.js applications using node-tar
• Need for input validation and sanitization of tar archive entries

Technical summary

The node-tar library for Node.js has a vulnerability prior to version 7.5.21, where a crafted GNU L or PAX x long-path header can cause a RangeError stack overflow. This issue occurs when the filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap. The vulnerability allows attackers to cause a denial-of-service (DoS) via crafted headers, impacting Node.js applications using node-tar. Developers should assess exposure and upgrade to version 7.5.21 or later.

Defensive priority

High

Recommended defensive actions

• Upgrade node-tar to version 7.5.21 or later
• Review and validate archive entries for potential crafted headers
• Implement input validation and sanitization for tar archive processing
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the node-tar vulnerability, which causes a RangeError stack overflow in certain versions prior to 7.5.21. The issue is triggered by a crafted GNU L or PAX x long-path header with thousands of slash-separated segments. Evidence is limited to public CVE and NVD records; defenders should verify affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.