--- id: CVE-2026-53655 title: >- node-tar: node-tar: File smuggling due to inconsistent tar archive parsing (CVE-2026-53655) summary: >- A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to … severity: medium cvss: 6.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N' cvssSource: vendor cwe: - CWE-115 - CWE-436 vendor: Red Hat product: Red Hat Enterprise Linux 10 affected: - confidential_compute_attestation - cryostat 4 - exploit_intelligence - migration_toolkit_for_containers - node_healthcheck_operator - openshift_lightspeed - openshift_pipelines - openshift_service_mesh 3 - pen_drive_powered_by_red_hat_lightspeed - 3scale_api_management_platform 2 - advanced_cluster_management_for_kubernetes 2 - amq_broker 7 - ansible_automation_platform 2 - ansible_automation_platform_ansible_core 2 - build_of_apache_camel_hawtio 4 - build_of_apache_camel_for_spring_boot 4 - build_of_podman_desktop - connectivity_link 1 - developer_hub - discovery 2 - enterprise_linux 10 - enterprise_linux 6 - enterprise_linux 7 - enterprise_linux 8 - enterprise_linux 9 - enterprise_linux_ai_rhel_ai 3 - enterprise_linux_command_line_assistant - jboss_enterprise_application_platform 7 - jboss_enterprise_application_platform_expansion_pack - offline_knowledge_portal - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_dev_spaces - openshift_update_service - quay 3 - satellite 6 - single_sign_on 7 - trusted_artifact_signer - trusted_profile_analyzer patched: - tar 7.5.16 published: '2026-06-22' updated: '2026-10-01' sourceUpdated: '2026-10-01T17:58:57+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53655.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53655.json - url: 'https://access.redhat.com/security/cve/CVE-2026-53655' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2491423' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-53655' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53655' - url: 'https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh' - url: 'https://github.com/advisories/GHSA-vmf3-w455-68vh' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.00156 epssPercentile: 0.04734 aliases: - GHSA-vmf3-w455-68vh ecosystem: npm ingestedAt: '2026-07-07T15:41:58.934Z' --- ## Overview A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to other standard tar implementations. A remote attacker could exploit this by crafting a malicious archive, causing different interpretations of archive contents between node-tar and other tools. This could allow an attacker to hide malicious files or sensitive information from security scanners that rely on different tar parsing libraries, potentially leading to information disclosure or bypassing security controls. ## Vendor advisories - **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Cryostat 4, Exploit Intelligence, Migration Toolkit for Containers, Node HealthCheck Operator, OpenShift Lightspeed, … · no fix planned: Confidential Compute Attestation, Cryostat 4, Exploit Intelligence, Migration Toolkit for Containers, … · updated 2026-10-01 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53655.json) **node-tar: node-tar: File smuggling due to inconsistent tar archive parsing** — rated Moderate by Red Hat. Released 2026-06-22, updated 2026-10-01. Affected: - Confidential Compute Attestation - Cryostat 4 - Exploit Intelligence - Migration Toolkit for Containers - Node HealthCheck Operator - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Service Mesh 3 - Pen Drive Powered by Red Hat Lightspeed - Red Hat 3scale API Management Platform 2 - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat AMQ Broker 7 - Red Hat Ansible Automation Platform 2 - Red Hat Ansible Automation Platform Ansible Core 2 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat build of Apache Camel for Spring Boot 4 - Red Hat Build of Podman Desktop - Red Hat Connectivity Link 1 - Red Hat Developer Hub - Red Hat Discovery 2 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 6 - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat Enterprise Linux command line assistant - Red Hat JBoss Enterprise Application Platform 7 - Red Hat JBoss Enterprise Application Platform Expansion Pack - Red Hat Offline Knowledge Portal - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Dev Spaces - Red Hat OpenShift Update Service - Red Hat Quay 3 - Red Hat Satellite 6 - Red Hat Single Sign-On 7 - Red Hat Trusted Artifact Signer - Red Hat Trusted Profile Analyzer No fix planned: - Confidential Compute Attestation - Cryostat 4 - Exploit Intelligence - Migration Toolkit for Containers - Node HealthCheck Operator - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Service Mesh 3 - Pen Drive Powered by Red Hat Lightspeed - Red Hat 3scale API Management Platform 2 - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat AMQ Broker 7 - Red Hat Ansible Automation Platform 2 - Red Hat Ansible Automation Platform Ansible Core 2 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat build of Apache Camel for Spring Boot 4 - Red Hat Build of Podman Desktop - Red Hat Connectivity Link 1 - Red Hat Developer Hub - Red Hat Discovery 2 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 6 - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat Enterprise Linux command line assistant - Red Hat JBoss Enterprise Application Platform 7 - Red Hat JBoss Enterprise Application Platform Expansion Pack - Red Hat Offline Knowledge Portal - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Dev Spaces - Red Hat OpenShift Update Service - Red Hat Quay 3 - Red Hat Satellite 6 - Red Hat Single Sign-On 7 - Red Hat Trusted Artifact Signer - Red Hat Trusted Profile Analyzer Not affected: - Red Hat Hardened Images ## Remediation Fix deferred Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2026-53655) Affected packages: - `tar <= 7.5.15` Patched in: - `tar 7.5.16` Source: https://github.com/advisories/GHSA-vmf3-w455-68vh