Interpretation Conflict in node-tar - CVE-2026-53655
Published: June 26, 2026
Vulnerability identifier: #VU135505
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53655
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to hide archive members from security tooling or downstream processing.
The vulnerability exists due to interpretation conflict in Header.decode in node-tar's tar parser when parsing an attacker-supplied tar archive containing a PAX extended header before intermediary GNU long-name or long-link headers. A remote attacker can supply a specially crafted archive to hide archive members from security tooling or downstream processing.
The issue occurs because PAX overrides such as size are applied to intermediary metadata headers, which can desynchronize parsing and cause different tar implementations to report different archive contents.
Affected software
node-tar
Maximo Application Suite - Visual Inspection Component
IBM App Connect Enterprise
Maximo Application Suite - Visual Inspection Component
IBM App Connect Enterprise
How to mitigate CVE-2026-53655
Install security update from vendor's website.
node-tar - update to 7.5.16
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.22, 9.1.19, 9.2.1
IBM App Connect Enterprise - addressed in versions 12.0.12.28, 13.0.8.0
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.22, 9.1.19, 9.2.1
IBM App Connect Enterprise - addressed in versions 12.0.12.28, 13.0.8.0