CVE-2026-53655

About vulnerability

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header’s size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar’s stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.

Affected product:

AlmaLinux 9.2 ESU , Alpine Linux 3.18 ELS , Amazon Linux 2 ELS , Angular , AngularJS , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , Debian 10 ELS , Debian 11 ELS , Next.js , Node.js , Oracle Linux 6 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , React , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS , adk-js , apollo-gateway , apollo-server-plugin-operation-registry , berry , build , c12 , cacache , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-explorer , celo-governance , celo-identity , celo-phone-number-privacy-common , cli , codesmith , copy-webpack-plugin , developer-tooling , duckdb-node , ember-cli , expo , facebook-create-react-app , giget , graphql-hive-envelop , graphql-mesh , graphql-yoga , grpc-node , guess , ionic-cli , jovidecroock-prefresh , jsdom , libcipm , libnpm , libnpmversion , make-fetch-happen , medplum , mikro-orm , minimizer-webpack-plugin , netlify-build , netlify-dev , netlify-functions-utils , netlify/functions , nft , nguniversal , npm , npm-lifecycle , npm-profile , npm-registry-fetch , npm:libnpmpack , npmcli-arborist , npmcli-metavuln-calculator , nuxt , opencensus-node , pacote , pdfjs-dist , protractor , remix , run-script , sigstore-js , sqlite3 , storybook , swarm-js , tar , tar-pack , telemetry , ts-evaluator , tuf-js , tuql , vercel , web3.js , webdriver-manager , webpack , webpack-cli-generators , yarnpkg-plugin-compat , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yarnpkg-sdks , yeoman-generator , yeoman/environment

Affected packages:

@angular/cli @ 19.2.25 (+728 more)