Node-tar is a tar handling library for Node.js that incorrectly applies a PAX extended header’s size override to intermediary GNU long-name (L) or long-link (K) metadata blocks. According to POSIX, a PAX header applies only to the next file entry, not to these intermediary extension headers. Because node-tar allows the size override to affect those headers, the parser’s stream cursor desynchronizes, causing different member listings compared to standard tools such as GNU tar or libarchive. The flaw maps to CWE-115, which involves improper handling of PAX headers, and also to CWE-436, reflecting the differing interpretation of archive entries. This allows an attacker to hide a file from one parser while it remains visible to another, undermining scanner and extractor consistency.

The vulnerability affects all versions of the isaacs node-tar package for Node.js prior to 7.5.16. Any Node.js application that imports node-tar to process tar archives—such as web services, build pipelines, or utility scripts—is potentially exposed.

The CVSS score of 6.9 indicates moderate severity, and the EPSS low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. An attacker can deliver a specially crafted tar archive to any vulnerable service or script that loads node-tar, causing the archive contents to be interpreted differently by that library compared to trusted tar tools. Based on the description, the likely attack vector is the unsolicited delivery of a crafted archive file, where the exploitation is straightforward but limited to environments that rely on node-tar for archive handling.