Node-tar desynchronizes its tar stream cursor when a PAX size override is applied to intermediary GNU long-name (L) or long-link (K) headers, contrary to POSIX PMP. This flaw causes a single crafted archive to produce different member listings for node-tar compared to standard tar implementations, allowing an attacker to hide files from one parser while revealing them to another, undermining scanners that rely on consistent archive contents. The weakness is classified as deparse mitigation failure (CWE‑436).

The vulnerability affects the isaacs node-tar package of Node.js for all versions older than 7.5.16. Any Node.js application importing this library and processing tar archives is potentially exposed.

With a CVSS score of 6.9 the flaw is considered moderate in severity. The EPSS score is not available, but the lack of a CISA KEV listing suggests limited known exploitation at the time of analysis. The attack vector is the delivery of a specially crafted tar archive to the vulnerable library, which could be executed via any Node.js service that opens tar files, making the risk significant for web applications or automated extraction tools.