The vulnerability in node-tar (up to and including version 7.5.3) stems from a race condition caused by incomplete handling of Unicode path collisions in the path-reservations system. On filesystems like macOS APFS that are case-insensitive or normalization-insensitive, conflicting Unicode paths (e.g., 'ß' and 'ss') are not properly serialized, allowing parallel processing of colliding paths. This bypasses the internal concurrency locks intended to prevent race conditions, enabling symlink poisoning and arbitrary file overwrite attacks. The patch in version 7.5.4 addresses this by changing the normalization form to match the target filesystem's behavior, applying locale-aware case transformations to ensure proper locking. Users extracting untrusted tarballs should filter out symbolic link entries as a temporary mitigation.

Successful exploitation allows an attacker to bypass concurrency safeguards in node-tar, leading to arbitrary file overwrite and symlink poisoning on affected filesystems. This can result in unauthorized modification of files during archive extraction, potentially compromising system integrity and security. The vulnerability is particularly relevant on macOS filesystems using APFS or HFS+, where Unicode normalization differences cause inode collisions that the library does not handle correctly.

An official patch is available in node-tar version 7.5.4 that fixes the Unicode normalization handling to prevent path collisions and race conditions. Users should upgrade to version 7.5.4 or later to fully remediate the vulnerability. For those unable to upgrade immediately, a recommended workaround is to programmatically filter out all symbolic link entries during tarball extraction, as done by npm, to mitigate arbitrary file overwrite risks. No other vendor advisories indicate alternative mitigations or that no action is required.