tar 4.4.19 | Snyk

Direct Vulnerabilities

Known vulnerabilities in the tar package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Uncaught Exception tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncaught Exception through improper handling of NUL bytes in the `src/pax.ts` file. An attacker can cause the application to terminate unexpectedly by providing a crafted archive containing NUL bytes in PAX path or linkpath records, which leads to an uncaught exception when these values are passed to filesystem operations. How to fix Uncaught Exception? Upgrade `tar` to version 7.5.17 or higher.	<7.5.17
H Allocation of Resources Without Limits or Throttling tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `tar` to version 7.5.19 or higher.	<7.5.19
M Incorrect Type Conversion or Cast tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast via the `src/pax.ts` file. An attacker can cause a process crash by providing all-digit PAX path or linkpath values that are coerced to JavaScript numbers, leading to a TypeError during downstream path handling. How to fix Incorrect Type Conversion or Cast? Upgrade `tar` to version 7.5.18 or higher.	<7.5.18
H Infinite loop tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size. How to fix Infinite loop? Upgrade `tar` to version 7.5.18 or higher.	<7.5.18
M Interpretation Conflict tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of PAX extended header `size` overrides in intermediary metadata headers. An attacker can cause inconsistent archive parsing results between different tar implementations by crafting a malicious tar archive that desynchronizes the parser's interpretation, potentially hiding files from scanners or extractors that rely on different tools. How to fix Interpretation Conflict? Upgrade `tar` to version 7.5.16 or higher.	<7.5.16
H Symlink Attack tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`. How to fix Symlink Attack? Upgrade `tar` to version 7.5.11 or higher.	<7.5.11
H Symlink Attack tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar. How to fix Symlink Attack? Upgrade `tar` to version 7.5.10 or higher.	<7.5.10
H Directory Traversal tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Directory Traversal via the `extract()` function. An attacker can read or write files outside the intended extraction directory by causing the application to extract a malicious archive containing a chain of symlinks leading to a hardlink, which bypasses path validation checks. How to fix Directory Traversal? Upgrade `tar` to version 7.5.8 or higher.	<7.5.8
M Directory Traversal tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Directory Traversal via processing of hardlinks. An attacker can read or overwrite arbitrary files on the file system by crafting a malicious TAR archive that bypasses path traversal protections during extraction. How to fix Directory Traversal? Upgrade `tar` to version 7.5.7 or higher.	<7.5.7
M Directory Traversal tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the `linkpath` parameter during archive extraction. An attacker can overwrite arbitrary files or create malicious symbolic links by crafting a tar archive with hardlink or symlink entries that resolve outside the intended extraction directory. How to fix Directory Traversal? Upgrade `tar` to version 7.5.3 or higher.	<7.5.3
M Improper Handling of Unicode Encoding tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in Path Reservations via Unicode Sharp-S (`ß`) Collisions on macOS APFS. An attacker can overwrite arbitrary files by exploiting Unicode normalization collisions in filenames within a malicious tar archive on case-insensitive or normalization-insensitive filesystems. Note: This is only exploitable if the system is running on a filesystem such as macOS APFS or HFS+ that ignores Unicode normalization. How to fix Improper Handling of Unicode Encoding? Upgrade `tar` to version 7.5.4 or higher.	<7.5.4
M Uncontrolled Resource Consumption ('Resource Exhaustion') tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the lack of folders count validation during the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running the software and even crash the client within few seconds of running it using a path with too many sub-folders inside. How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')? Upgrade `tar` to version 6.2.1 or higher.	<6.2.1

Vulnerability

Vulnerable Version

Uncaught Exception

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Uncaught Exception through improper handling of NUL bytes in the src/pax.ts file. An attacker can cause the application to terminate unexpectedly by providing a crafted archive containing NUL bytes in PAX path or linkpath records, which leads to an uncaught exception when these values are passed to filesystem operations.

How to fix Uncaught Exception?

Upgrade tar to version 7.5.17 or higher.

<7.5.17

Allocation of Resources Without Limits or Throttling

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade tar to version 7.5.19 or higher.

<7.5.19

Incorrect Type Conversion or Cast

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast via the src/pax.ts file. An attacker can cause a process crash by providing all-digit PAX path or linkpath values that are coerced to JavaScript numbers, leading to a TypeError during downstream path handling.

How to fix Incorrect Type Conversion or Cast?

Upgrade tar to version 7.5.18 or higher.

<7.5.18

Infinite loop

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Infinite loop via the replace method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.

How to fix Infinite loop?

Upgrade tar to version 7.5.18 or higher.

<7.5.18

Interpretation Conflict

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of PAX extended header size overrides in intermediary metadata headers. An attacker can cause inconsistent archive parsing results between different tar implementations by crafting a malicious tar archive that desynchronizes the parser's interpretation, potentially hiding files from scanners or extractors that rely on different tools.

How to fix Interpretation Conflict?

Upgrade tar to version 7.5.16 or higher.

<7.5.16

Symlink Attack

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack via tar.x() extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like C:../../../target.txt.

How to fix Symlink Attack?

Upgrade tar to version 7.5.11 or higher.

<7.5.11

Symlink Attack

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack exploitable via stripAbsolutePath(), used by the Unpack class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose linkpath uses a drive-relative path such as C:../target.txt in a malicious tar.

How to fix Symlink Attack?

Upgrade tar to version 7.5.10 or higher.

<7.5.10

Directory Traversal

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via the extract() function. An attacker can read or write files outside the intended extraction directory by causing the application to extract a malicious archive containing a chain of symlinks leading to a hardlink, which bypasses path validation checks.

How to fix Directory Traversal?

Upgrade tar to version 7.5.8 or higher.

<7.5.8

Directory Traversal

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via processing of hardlinks. An attacker can read or overwrite arbitrary files on the file system by crafting a malicious TAR archive that bypasses path traversal protections during extraction.

How to fix Directory Traversal?

Upgrade tar to version 7.5.7 or higher.

<7.5.7

Directory Traversal

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the linkpath parameter during archive extraction. An attacker can overwrite arbitrary files or create malicious symbolic links by crafting a tar archive with hardlink or symlink entries that resolve outside the intended extraction directory.

How to fix Directory Traversal?

Upgrade tar to version 7.5.3 or higher.

<7.5.3

Improper Handling of Unicode Encoding

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in Path Reservations via Unicode Sharp-S (ß) Collisions on macOS APFS. An attacker can overwrite arbitrary files by exploiting Unicode normalization collisions in filenames within a malicious tar archive on case-insensitive or normalization-insensitive filesystems.

Note:

This is only exploitable if the system is running on a filesystem such as macOS APFS or HFS+ that ignores Unicode normalization.

How to fix Improper Handling of Unicode Encoding?

Upgrade tar to version 7.5.4 or higher.

<7.5.4

Uncontrolled Resource Consumption ('Resource Exhaustion')

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the lack of folders count validation during the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running the software and even crash the client within few seconds of running it using a path with too many sub-folders inside.

How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

Upgrade tar to version 6.2.1 or higher.

<6.2.1

tar@4.4.19

tar for node

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically