{"id":"CVE-2026-53655","revision":"6f214ce9f7fd49329c084ab79255e014","records":[{"revision":"6f214ce9f7fd49329c084ab79255e014","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53655","aliases":[],"title":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","state":0,"publishedAt":"2026-06-22T14:55:50.133+00:00","modifiedAt":"2026-06-23T16:09:06.835+00:00","affected":[{"ecosystem":"Vendor product","name":"node-tar","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"isaacs\",\n                    \"product\": \"node-tar\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.5.16\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53655","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53655","identifiers":["CVE-2026-53655"]},"retained":false,"historicalAffected":[]}],"coverage":[]}