tar Known Vulnerabilities & Fixes
tar has 10 known security vulnerabilities in npm (Node.js). Upgrade to version 7.5.8 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
High Exploitation Risk
1 vulnerability has >50% exploit probability. Review and update soon.
Recommended safe version: 7.5.8
Upgrading to 7.5.8 or later resolves all 10 known vulnerabilities in tar. Run: npm install tar@7.5.8
Is tar in your project?
Check if you're affected and upgrade to 7.5.8 to stay secure.
Security Summary
- 22 affected version ranges have been identified across these 10 advisories.
- 100% of known issues have a published fixed version.
- Highest exploit-probability (EPSS) score for tar: 85.0%.
- Remediation: npm update tar
Vulnerabilities
10 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Aug 3, 2021, most recently Feb 18, 2026 (1659 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2021-32804 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization | HIGH | All versions | 3.2.2, 4.4.14, 5.0.6 (+1 more) |
| CVE-2021-37713 Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization | HIGH | All versions | 4.4.18, 5.0.10, 6.1.9 |
| CVE-2024-28863 Denial of service while parsing a tar file due to lack of folders count validation | MEDIUM | All versions | 6.2.1 |
| CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning | HIGH | All versions | 3.2.3, 4.4.15, 5.0.7 (+1 more) |
| CVE-2021-37701 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links | HIGH | All versions | 4.4.16, 5.0.8, 6.1.7 |
| CVE-2021-37712 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links | HIGH | All versions | 4.4.18, 5.0.10, 6.1.9 |
| CVE-2026-24842 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal | HIGH | All versions | 7.5.7 |
| CVE-2026-26960 Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction | HIGH | All versions | 7.5.8 |
| CVE-2026-23745 node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | HIGH | All versions | 7.5.3 |
| CVE-2026-23950 Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS | HIGH | All versions | 7.5.4 |
About This Data
Vulnerability data for tar is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related npm (Node.js) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of tar.