Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
isaacs node-tar — node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
L L N N N N H N 6.9 .0014 4.0 —
AFFECTED
Product Versions Fixed
node-tar < 7.5.16 – —
TIMELINE
Jun 9 Reserved by GitHub_M
Jun 22 EXPLOIT PUBLISHED — CVE-2026-53655 (isaacs node-tar). Public exploit reference added.
Jun 22 Published (CNA: GitHub_M)
Description
node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 9, 2026 | Reserved | Reserved by GitHub_M |
| June 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-53655 (isaacs node-tar). Public exploit reference added. |
| June 22, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| isaacs | node-tar | — | < 7.5.16 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-53655 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.