https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:54:14 +0000 https://db.gcve.eu/vuln/ghsa-vmf3-w455-68vh <p><strong>Affected:</strong> npm: tar</p> <p>### Summary</p> <p>`tar` (node-tar) applies a PAX extended header&#39;s `size=` record (and other PAX overrides) to the **next header entry of any type**, including intermediary metadata headers such as a GNU long-name (`L`) or long-link (`K`) entry. Per POSIX pax, a PAX extended header (`x`) describes the *next file entry*, not the intermediary extension headers that may sit between the `x` header and the file it annotates. Because node-tar lets the PAX `size` override the byte length of an intervening `L`/`K`/`x` header, an attacker can desynchronize node-tar&#39;s stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python `tarfile`, and the now-fixed `tar-rs` / `astral-tokio-tar`).</p> <p>The result is a tar parser **interpretation differential** (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another). node-tar is one of the most widely deployed JavaScript tar libraries (it backs `npm`&#39;s own package-tarball handling and is a transitive dependency of a very large fraction of the npm ecosystem), so the blast radius for &#34;files that extract differently depending on the tool&#34; is broad.</p> <p>This is the sam…</p> <p><strong>Affected:</strong> npm: tar</p> <p>### Summary</p> <p>`tar` (node-tar) applies a PAX extended header&#39;s `size=` record (and other PAX overrides) to the **next header entry of any type**, including intermediary metadata headers such as a GNU long-name (`L`) or long-link (`K`) entry. Per POSIX pax, a PAX extended header (`x`) describes the *next file entry*, not the intermediary extension headers that may sit between the `x` header and the file it annotates. Because node-tar lets the PAX `size` override the byte length of an intervening `L`/`K`/`x` header, an attacker can desynchronize node-tar&#39;s stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python `tarfile`, and the now-fixed `tar-rs` / `astral-tokio-tar`).</p> <p>The result is a tar parser **interpretation differential** (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another). node-tar is one of the most widely deployed JavaScript tar libraries (it backs `npm`&#39;s own package-tarball handling and is a transitive dependency of a very large fraction of the npm ecosystem), so the blast radius for &#34;files that extract differently depending on the tool&#34; is broad.</p> <p>This is the sam…</p> https://db.gcve.eu/vuln/ghsa-vmf3-w455-68vh