unstale

npm / tar

tar

What changed in tar 7, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

13 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

tar 713 changes

Security 13

  • node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

    7.5.21security advisory

  • node-tar: Decompression/parse DoS via unlimited input

    7.5.19security advisory

  • node-tar: Negative tar entry size causes infinite loop in archive replace

    7.5.18security advisory

  • node-tar: Process crash via PAX numeric path type confusion

    7.5.18security advisory

  • node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

    7.5.17security advisory

  • node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

    7.5.16security advisory

  • node-tar Symlink Path Traversal via Drive-Relative Linkpath

    7.5.11security advisory

  • tar has Hardlink Path Traversal via Drive-Relative Linkpath

    7.5.10security advisory

  • Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

    7.5.8security advisory

  • node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

    7.5.7security advisory

  • Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

    7.5.4security advisory

  • node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    7.5.3security advisory

  • node-tar has a race condition leading to uninitialized memory exposure

    7.5.2security advisory