The bug arises from node-tar converting all‑digit PAX path and linkpath strings into JavaScript numbers before they are used by path handling functions. This type confusion causes a TypeError during path normalization.js process terminating. Users of the library that extract tar archives from untrusted sources could therefore experience an unplanned process shutdown, interrupting services or desynchronizing state, but there is no direct disclosure of secrets or arbitrary code execution.

The affected product is the node‑tar package published by isaacs. Versions earlier than 7.5.18 are vulnerable; the fix was introduced in release 7.5.18. Any Node.js application that depends on node‑tar without updating to a patched version is at risk.

The CVSS score of 5.3 indicates a moderate severity. EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is via input supplied to an application that uses node‑tar to extract tar files, implying that an attacker could trigger the crash by crafting an archive with numeric PAX paths. The vulnerability does not grant code execution or privilege escalation of‑service objectives.