{"id":"CVE-2026-53655","title":"node-tar: node-tar: File smuggling due to inconsistent tar archive parsing (CVE-2026-53655)","summary":"A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","cvssSource":"vendor","cwe":["CWE-115","CWE-436"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["confidential_compute_attestation","cryostat 4","exploit_intelligence","migration_toolkit_for_containers","node_healthcheck_operator","openshift_lightspeed","openshift_pipelines","openshift_service_mesh 3","pen_drive_powered_by_red_hat_lightspeed","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2","amq_broker 7","ansible_automation_platform 2","ansible_automation_platform_ansible_core 2","build_of_apache_camel_hawtio 4","build_of_apache_camel_for_spring_boot 4","build_of_podman_desktop","connectivity_link 1","developer_hub","discovery 2","enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","enterprise_linux_command_line_assistant","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform_expansion_pack","offline_knowledge_portal","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_update_service","quay 3","satellite 6","single_sign_on 7","trusted_artifact_signer","trusted_profile_analyzer"],"patched":["tar 7.5.16"],"published":"2026-06-22","updated":"2026-10-01","sourceUpdated":"2026-10-01T17:58:57+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53655.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53655.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-53655"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491423"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53655"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655"},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"},{"url":"https://github.com/advisories/GHSA-vmf3-w455-68vh"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00156,"epssPercentile":0.04734,"aliases":["GHSA-vmf3-w455-68vh"],"ecosystem":"npm","ingestedAt":"2026-07-07T15:41:58.934Z","slug":"CVE-2026-53655","body":"## Overview\n\nA flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to other standard tar implementations. A remote attacker could exploit this by crafting a malicious archive, causing different interpretations of archive contents between node-tar and other tools. This could allow an attacker to hide malicious files or sensitive information from security scanners that rely on different tar parsing libraries, potentially leading to information disclosure or bypassing security controls.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Cryostat 4, Exploit Intelligence, Migration Toolkit for Containers, Node HealthCheck Operator, OpenShift Lightspeed, … · no fix planned: Confidential Compute Attestation, Cryostat 4, Exploit Intelligence, Migration Toolkit for Containers, … · updated 2026-10-01 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53655.json)\n\n**node-tar: node-tar: File smuggling due to inconsistent tar archive parsing** — rated Moderate by Red Hat. Released 2026-06-22, updated 2026-10-01.\n\nAffected:\n\n- Confidential Compute Attestation\n- Cryostat 4\n- Exploit Intelligence\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Service Mesh 3\n- Pen Drive Powered by Red Hat Lightspeed\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat Build of Podman Desktop\n- Red Hat Connectivity Link 1\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Enterprise Linux command line assistant\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Update Service\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Single Sign-On 7\n- Red Hat Trusted Artifact Signer\n- Red Hat Trusted Profile Analyzer\n\nNo fix planned:\n\n- Confidential Compute Attestation\n- Cryostat 4\n- Exploit Intelligence\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Service Mesh 3\n- Pen Drive Powered by Red Hat Lightspeed\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat Build of Podman Desktop\n- Red Hat Connectivity Link 1\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Enterprise Linux command line assistant\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Update Service\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Single Sign-On 7\n- Red Hat Trusted Artifact Signer\n- Red Hat Trusted Profile Analyzer\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-53655)\n\nAffected packages:\n\n- `tar <= 7.5.15`\n\nPatched in:\n\n- `tar 7.5.16`\n\nSource: https://github.com/advisories/GHSA-vmf3-w455-68vh","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":214821,"id":"CVE-2026-53655","ts":1790927910244,"field":"cvss","old":null,"new":"6.1"}]}