CVE-2026-73566

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the filesFilter function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.

Important: A denial of service vulnerability exists in the node-tar library, affecting Node.js applications that process untrusted tar archives with member selection. A remote attacker could exploit this by providing a specially crafted archive containing excessively long paths, leading to an uncatchable stack overflow and termination of the consuming Node.js application. This is considered Important due to the potential for service disruption in applications handling untrusted archive content.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.