isaacs tar

node-tar: Decompression/parse DoS via unlimited input

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

node-tar: Negative tar entry size causes infinite loop in archive replace

node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

node-tar Symlink Path Traversal via Drive-Relative Linkpath

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

node-tar: Process crash via PAX numeric path type confusion

node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation