CVE-2026-53655: node-tar Information Disclosure Flaw

CVE-2026-53655 Overview

CVE-2026-53655 is a parser interpretation differential vulnerability [CWE-436] affecting node-tar, a tar archive library for Node.js. Versions prior to 7.5.16 incorrectly apply a PAX extended header's size= record to intermediary metadata headers, including GNU long-name (L) and long-link (K) entries. This behavior violates POSIX pax specifications and desynchronizes the node-tar stream cursor relative to GNU tar, libarchive/bsdtar, Python tarfile, and tar-rs. Attackers can craft archives that expose different members to different parsers, defeating security tooling where a scanner and extractor disagree on archive contents.

Critical Impact
A crafted tar archive can hide malicious files from malware or secret scanners while exposing them to downstream extractors, bypassing scan-then-extract security pipelines.

Affected Products

node-tar versions prior to 7.5.16
Node.js applications and toolchains that depend on node-tar for archive parsing
Security scanners and extraction pipelines that use node-tar alongside other tar implementations

Discovery Timeline

2026-06-22 - CVE-2026-53655 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-53655

Vulnerability Analysis

The vulnerability stems from incorrect application of PAX extended header overrides in node-tar. Per POSIX pax, a PAX extended header (type x) describes the next file entry. It should not apply to intermediary extension headers that sit between the x header and the annotated file. Node-tar incorrectly applies the PAX size= record to any next header entry, including GNU long-name (L) and long-link (K) headers.

This behavior allows an attacker to alter the byte length that node-tar assigns to an intervening L or K header. The stream cursor advances by a different number of bytes than in compliant tar implementations. A single crafted archive then yields different sets of members when parsed by node-tar versus GNU tar, libarchive/bsdtar, or Python tarfile.

The issue is classified as an interpretation conflict [CWE-436]. The security impact emerges when one tool lists archive contents while another extracts them. A malware scanner using node-tar may report a benign file list while a downstream extractor using GNU tar writes a malicious file to disk.

Root Cause

Node-tar treats the PAX extended header's size= override as applicable to the immediately following header block regardless of type. The POSIX pax specification requires the override to apply only to the next file entry, skipping intervening L, K, or additional x extension headers. This deviation creates the parser desynchronization.

Attack Vector

An attacker crafts a tar archive containing a PAX extended header with a manipulated size= field followed by a GNU long-name or long-link header and then the target file entry. When node-tar processes the archive, the cursor advances incorrectly and either skips or misattributes entries. Other tar parsers process the same archive correctly, producing a different member list. The attack requires local archive delivery to a system where node-tar participates in a multi-parser workflow.

The vulnerability is described in prose only. See the GitHub Security Advisory for full technical details and proof-of-concept references.

Detection Methods for CVE-2026-53655

Indicators of Compromise

Tar archives containing PAX extended headers (x type) immediately followed by GNU long-name (L) or long-link (K) headers with mismatched size declarations
Discrepancies between tar -tvf output from GNU tar and node-tar listing of the same archive
Build or CI pipeline logs showing files extracted that were not present in prior scan output

Detection Strategies

Compare archive member listings produced by node-tar against GNU tar, bsdtar, or Python tarfile for any archive entering a security boundary
Inspect dependency manifests (package.json, package-lock.json) for node-tar versions below 7.5.16
Audit security scanner and extractor pairs in build pipelines to identify cases where different tar libraries are used

Monitoring Recommendations

Log archive extraction operations including file counts and hashes for cross-reference against prior scan results
Alert on tar archives whose PAX extended header size= value differs from the actual subsequent header block size
Track upgrades of node-tar across repositories using software composition analysis tooling

How to Mitigate CVE-2026-53655

Immediate Actions Required

Upgrade node-tar to version 7.5.16 or later across all Node.js projects and container images
Audit CI/CD and security-scanning pipelines for mixed tar implementations between scanning and extraction stages
Rebuild and redeploy applications that bundle vulnerable node-tar versions

Patch Information

The vulnerability is fixed in node-tar version 7.5.16. The patch corrects PAX extended header handling so that size= overrides apply only to the next file entry, matching POSIX pax behavior and other mainstream tar parsers. Refer to the GitHub Security Advisory GHSA-vmf3-w455-68vh for release details.

Workarounds

Standardize on a single tar implementation across scanning and extraction stages to eliminate parser differential exposure
Reject archives where PAX extended header size= records target intermediary L or K headers prior to extraction
Restrict ingestion of untrusted tar archives until dependent services are patched

bash

# Upgrade node-tar to the fixed version
npm install tar@^7.5.16

# Verify installed version
npm ls tar

# Audit project dependencies for vulnerable versions
npm audit