CVE-2026-73566: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73566 is an uncontrolled recursion vulnerability in node-tar (npm package tar) that allows unauthenticated remote attackers to crash Node.js applications via a crafted tar archive, resulting in a denial of service. The flaw exists in versions up to and including 7.5.20 of the tar npm package, and was fixed in version 7.5.21. It was published on August 13, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) and uncontrolled resource consumption (CWE-400) in the mapHas helper function within src/list.ts. When tar.t() or tar.x() is called with a non-empty member-selection list, a filesFilter is installed that invokes mapHas, which recursively calls path.dirname() once per path segment with no depth cap. A crafted GNU-L or PAX-x long-path header can deliver a path with tens of thousands of slash-separated segments (up to the 1 MiB maxMetaEntrySize limit), triggering the recursion at Parser[CONSUMEHEADER] in src/parse.ts — critically, before the Unpack[CHECKPATH] maxDepth guard executes on the entry event. The resulting RangeError: Maximum call stack size exceeded is uncatchable in async and streaming consumers (the dominant server pattern), escaping as an uncaughtException that terminates the Node.js process; standard try/catch around the async call does not prevent it (GitHub Advisory, Fix Commit).

Successful exploitation causes immediate, uncatchable termination of the Node.js process in any service that lists or extracts selected members from an untrusted archive using the async or streaming API. Affected use cases include package registries, CI artifact/cache restore pipelines, and file upload processors. There is no confidentiality or integrity impact; the vulnerability is a pure availability (DoS) issue. A ~188-byte gzip file (~26 KB uncompressed tar) is sufficient to crash the target process (GitHub Advisory).

A proof-of-concept is described in the GitHub Security Advisory and has been confirmed empirically on Node.js v24.18.0 against node-tar 7.5.20. The attack is network-accessible, requires no authentication or user interaction, and is automatable (NVD SSVC: automatable=yes). The EPSS score is approximately 0.38%, indicating low but non-negligible probability of exploitation in the wild. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Red Hat Bugzilla).

1. Craft the malicious archive: Create a tar archive with a GNU-L (long link) or PAX-x extended header whose body consists of approximately 12,000 repetitions of a/ (~26 KB), followed by a normal file entry. Gzip-compress the archive (resulting in ~188 bytes).
2. Identify a vulnerable target: Find a Node.js service that processes user-supplied tar archives using tar.t() or tar.x() with a non-empty member-selection list (e.g., tar.t({ file: 'input.tar.gz', gzip: true }, ['some-member'])).
3. Deliver the archive: Submit the crafted .tar.gz file to the target service via any supported upload or processing mechanism (HTTP upload, CI artifact submission, package registry push, etc.).
4. Trigger the crash: When the service processes the archive with member selection, filesFilter/mapHas recurses over the thousands of path segments, overflowing the call stack. The uncatchable RangeError propagates as an uncaughtException, terminating the Node.js process (GitHub Advisory).

• Logs: Node.js process logs showing RangeError: Maximum call stack size exceeded originating from mapHas in node_modules/tar/dist/commonjs/list.js or src/list.ts; uncaughtException events in application logs immediately preceding unexpected process termination.
• Process: Sudden, unexpected termination of the Node.js application process without a graceful shutdown sequence; process manager (e.g., PM2, systemd) logs showing repeated restarts of the Node.js service.
• File System: Presence of unusually small (sub-200-byte) .tar.gz files in upload directories or temporary processing folders that, when inspected, contain a GNU-L or PAX-x header with an extremely long path body.
• Network: Repeated submission of small gzip-compressed tar archives (under 1 KB) to endpoints that process tar files, particularly correlated with service crashes (GitHub Advisory).

Upgrade the tar npm package to version 7.5.21 or later, which rewrites mapHas to accept a depth parameter and enforces a hard cap of 100 recursion levels, preventing stack exhaustion (Fix Commit). As a temporary workaround where upgrading is not immediately possible, avoid passing a non-empty member-selection list to tar.t() or tar.x() when processing untrusted archives, or validate and reject archives with excessively long path segments before passing them to node-tar. Implementing resource limits and input validation on archive processing pipelines is also recommended as a defense-in-depth measure (GitHub Advisory).

Red Hat tracked the vulnerability as a high-severity issue in their Bugzilla system (Bug 2515509), with a large CC list of product security engineers indicating broad internal concern across Red Hat products that depend on node-tar. The vulnerability was reported by researcher Jace (@manus-use on GitHub) and disclosed responsibly through GitHub's security advisory process. No significant public social media discussion or major media coverage has been identified beyond standard vulnerability database aggregation (Red Hat Bugzilla, GitHub Advisory).