The vulnerability arises from node-tar failing to strip NUL bytes from PAX path and linkpath records. A crafted tar archive can cause fs.lstat or fs.open to receive a string containing a NUL byte, triggering an uncaught exception that crashes the Node.js process. This results in a denial of service to the application using the library. The weakness is identified as CWE-170 and CWE-248.

The affected product is the node-tar library maintained by isaacs. Versions prior to 7.5.17 are vulnerable. Any Node.js application that imports node-tar and extracts tar archives—including those from untrusted sources— is affected.

The CVSS score of 5.3 and an EPSS score of < 1% indicate a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is most likely remote if the application accepts archives from external inputs. The complexity is low because the library automatically processes each entry, so a single malicious tar file suffices to trigger the crash. The overall risk is moderate, particularly in environments that routinely handle untrusted archives.