Uncontrolled Recursion in tar - #VU139375
Published: July 26, 2026
Vulnerability identifier: #VU139375
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the mapHas helper used by filesFilter when processing a crafted tar archive with a non-empty member-selection list. A remote attacker can supply a specially crafted archive with a long path to cause a denial of service.
On async and streaming consumers, the resulting stack overflow raises an uncaught RangeError that terminates the Node process. The issue is triggered when listing or extracting selected members from an untrusted archive.
Affected software
tar
Remediation
Install security update from vendor's website.
tar - update to 7.5.21