CVE-2026-53655

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.

• CWE-436

• https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vhExploit, Mitigation, Vendor Advisory
• https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vhExploit, Mitigation, Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53647FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-53648FOSSBilling is a free, open-source billing and client manage…5.1
• CVE-2026-53649Joro is a web exploitation framework. Prior to version 1.1.1…9.6
• CVE-2026-5365The LatePoint plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2026-53653Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0…8.7
• CVE-2026-53654Grav is a file-based Web platform. Prior to 3.8.5, the Login…5.3
• CVE-2026-53656FiftyOne is an open-source platform for refining high-qualit…6.3
• CVE-2026-53657Lima launches Linux virtual machines, typically on macOS, fo…8.2
• CVE-2026-53658Fabric CA is a Certificate Authority for Hyperledger Fabric.…6.3
• CVE-2026-53659http4k is a functional toolkit for Kotlin HTTP applications.…7.5
• CVE-2026-5366Prefect version 3.6.23 is vulnerable to remote code executio…9.9
• CVE-2026-53660Open Access Management (OpenAM) is an access management solu…7.4