# What changed in tar

> 13 changes in tar 7 from its official release notes, upgrade guides and advisories: 13 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/tar/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## tar 7

### Security

- node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection (7.5.21) — [security advisory](https://github.com/advisories/GHSA-R292-9MHP-454M)
- node-tar: Decompression/parse DoS via unlimited input (7.5.19) — [security advisory](https://github.com/advisories/GHSA-23HP-3JRH-7FPW)
- node-tar: Negative tar entry size causes infinite loop in archive replace (7.5.18) — [security advisory](https://github.com/advisories/GHSA-8X88-C5MF-7J5W)
- node-tar: Process crash via PAX numeric path type confusion (7.5.18) — [security advisory](https://github.com/advisories/GHSA-W8WR-V893-VJVP)
- node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records (7.5.17) — [security advisory](https://github.com/advisories/GHSA-GVWX-54WH-QM9J)
- node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) (7.5.16) — [security advisory](https://github.com/advisories/GHSA-VMF3-W455-68VH)
- node-tar Symlink Path Traversal via Drive-Relative Linkpath (7.5.11) — [security advisory](https://github.com/advisories/GHSA-9PPJ-QMQM-Q256)
- tar has Hardlink Path Traversal via Drive-Relative Linkpath (7.5.10) — [security advisory](https://github.com/advisories/GHSA-QFFP-2RHF-9H96)
- Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction (7.5.8) — [security advisory](https://github.com/advisories/GHSA-83G3-92JG-28CX)
- node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal (7.5.7) — [security advisory](https://github.com/advisories/GHSA-34X7-HFP2-RC4V)
- Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS (7.5.4) — [security advisory](https://github.com/advisories/GHSA-R6Q2-HW4H-H46W)
- node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization (7.5.3) — [security advisory](https://github.com/advisories/GHSA-8QQ5-RM4J-MR97)
- node-tar has a race condition leading to uninitialized memory exposure (7.5.2) — [security advisory](https://github.com/advisories/GHSA-29XP-372Q-XQPH)