CVE-2026-53655: Node-tar PAX Parser Differential Vulnerability

Technical summary

CVE-2026-53655 exploits a deviation from POSIX PAX specification in node-tar versions prior to 7.5.16. The vulnerability arises because node-tar incorrectly applies a PAX extended header's size= override to intervening metadata headers (GNU long-name [L] and long-link [K] entries) rather than only to the primary file entry that the PAX header describes. Per POSIX standard, PAX headers annotate the next file entry, not the extension headers between the PAX header and that file. By manipulating the size= field in a PAX record, an attacker forces node-tar's stream cursor to desynchronize relative to compliant parsers. This results in a tar parser interpretation differential (CWE-436): the same archive produces divergent member lists across implementations. Node-tar's incorrect cursor position causes it to parse or skip different entries than GNU tar, libarchive/bsdtar, Python tarfile, and the corrected tar-rs library.

Business impact

Organizations relying on node-tar for archive processing face two main risks. First, security scanning pipelines that enumerate archive contents with one library and extract with node-tar may be bypassed—a crafted archive could contain hidden files (malware, credentials, proprietary data) that the scanner does not detect but node-tar extracts. Second, any application using node-tar to process untrusted archives without additional validation is vulnerable to supply-chain attacks, particularly in software distribution contexts where tar files are downloaded and processed automatically. The impact depends on whether node-tar is used in security-critical workflows; if it is the sole extraction mechanism, the risk is moderate; if it is part of a multi-layer defense, the risk is lower but still present.

Affected systems

Node-tar versions prior to 7.5.16 are affected. The vulnerability exists in the isaacs tar package, which is widely used in the Node.js ecosystem as a dependency for archive manipulation, build tooling, and package distribution. Any application or tool that bundles or directly depends on node-tar <7.5.16 is potentially affected. This includes npm packages that use node-tar for installation scripts, build processes, or runtime archive operations, as well as standalone Node.js applications that unpack or validate tar archives.

Exploitability

Exploitation requires the attacker to craft a malicious tar archive with carefully positioned PAX extended headers and intermediary metadata entries. The attacker must understand the specific parsing behavior of node-tar and construct an archive such that the PAX size override causes misalignment. A user or system must then process the crafted archive with node-tar. Exploitability is constrained by user interaction (the archive must be processed) and local attack surface; however, in automated or supply-chain contexts (e.g., npm install hooks, container image extraction), the barrier is lower. Public exploit code or proof-of-concept demonstrations would lower the bar further, but none have been observed yet. The CVSS score of 5.5 (Medium) reflects local attack vector and required user interaction, tempered by the high integrity impact.

Remediation

Update node-tar to version 7.5.16 or later. This version corrects the PAX header handling to comply with POSIX specification, ensuring that PAX size overrides apply only to the annotated file entry and not to intervening metadata headers. Organizations should verify dependency versions in their package-lock.json or yarn.lock and initiate a controlled upgrade across all affected projects. For applications with long dependency chains, use npm audit and npm update to identify and patch affected transitive dependencies.

Patch guidance

Upgrade isaacs tar to version 7.5.16 or later. In most Node.js projects, run `npm install tar@latest` or update the version constraint in package.json to ^7.5.16 (or >=7.5.16 depending on your versioning strategy) and run npm install. If tar is a transitive dependency, update the direct dependency that pulls it in, then run npm install to ensure the correct version is resolved. Verify the upgrade with `npm list tar` to confirm version 7.5.16 or later is installed. For production environments, test the patch in a staging environment first, particularly if you have custom tar-processing logic or security scanning integrations.

Detection guidance

Detection is challenging at runtime because the vulnerability relies on archive structure, not code execution signatures. Consider these approaches: (1) Monitor and audit which versions of node-tar are deployed across your codebase using `npm audit` and software composition analysis (SCA) tools. (2) If you operate a security scanning pipeline, audit whether the scanner and extraction tool use the same tar library; mismatches are a red flag. (3) For suspicious or untrusted tar archives, run them through both node-tar and a reference implementation (e.g., system tar command) and compare the member lists programmatically. (4) In supply-chain scenarios (npm install, container image pulls), implement artifact signing and verification to ensure archives have not been tampered with in transit.

Why prioritize this

This vulnerability should be prioritized in environments where node-tar is used in security-critical workflows or supply-chain processes. Tier 1 priority: applications that use node-tar to scan or validate untrusted archives (malware detection, secrets scanning, compliance scanning). Tier 2 priority: npm packages and tools that extract archives as part of automated build or install processes. Tier 3 priority: applications where node-tar is used only for trusted, internal archives. The Medium CVSS score reflects the constraint that exploitation requires a crafted archive and user interaction, but the integrity impact (hiding files) and potential for security tool bypass elevate the practical risk in certain contexts.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) is calculated as CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. Attack Vector Local reflects that the attacker must supply a crafted archive to the target system. Attack Complexity Low means the archive construction, while requiring knowledge of node-tar's behavior, is straightforward once understood. Privileges Required None and User Interaction Required indicate that an unprivileged user must process the archive. Scope Unchanged means the impact is limited to the archive processing context. Confidentiality impact is None (no data disclosure), but Integrity is High because the attacker can hide or misrepresent archive contents, defeating validation logic. Availability is not impacted. The score appropriately reflects a medium-severity integrity flaw that is not universally critical but is serious in security-sensitive contexts.

Frequently asked questions