node-tar versions before 7.5.16 incorrectly apply PAX extended header size overrides to intermediary metadata headers (such as GNU long-name or long-link entries) rather than only to the next file entry as specified by POSIX pax. This causes node-tar's stream cursor to become desynchronized relative to other mainstream tar implementations, resulting in a parser interpretation differential (CWE-436). An attacker can exploit this to craft archives that present different file member sets depending on the tar parser used, potentially bypassing security tools that rely on consistent archive content enumeration and extraction. The vulnerability is addressed in node-tar version 7.5.16.

The vulnerability allows an attacker to create tar archives that are interpreted differently by node-tar compared to other standard tar tools. This can be used to hide malicious or sensitive files from security scanners that use one parser while allowing extraction by another, undermining the reliability of security tooling and potentially enabling evasion of malware detection or unauthorized data disclosure.

This vulnerability is fixed in node-tar version 7.5.16. Users should upgrade to version 7.5.16 or later to remediate this issue. No other mitigation is indicated by the vendor advisory.