What is CVE-2026-53655?

CVE-2026-53655 is a medium-severity vulnerability in Isaacs Node-tar, classified under CWE-436. CVSS score: 5.5/10. Published 2026-06-22.

How severe is CVE-2026-53655?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Isaacs Node-tar

CVE-2026-53655

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU…

EPSS: 0.001 (3.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Isaacs Node-tar — versions < 7.5.16
Isaacs Tar

Weakness classification (CWE)

CWE-436

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-53655?: CVE-2026-53655 is a medium-severity vulnerability in Isaacs Node-tar, classified under CWE-436. CVSS score: 5.5/10. Published 2026-06-22.
How severe is CVE-2026-53655?: Medium severity. CVSS v3 base score is 5.5 out of 10.