The vulnerability in node-tar arises from the filesFilter function in src/list.ts, which uses a recursive helper to walk upward through archive entry paths without limiting the number of path segments. When tar.t(...) or tar.x(...) is called with a non-empty member-selection list, a specially crafted GNU L or PAX long-path header containing thousands of slash-separated segments can trigger this recursive path walk. This leads to an uncatchable RangeError stack overflow in the filter function before the maxDepth check in Unpack[CHECKPATH] is applied. The result is termination of asynchronous and streaming Node.js consumers. The flaw is addressed in node-tar version 7.5.21.

Exploitation of this vulnerability results in a denial of service condition by causing a stack overflow that terminates Node.js processes consuming tar archives asynchronously or via streams. There is no impact on confidentiality or integrity. The CVSS v3.1 score of 7.5 reflects a high severity denial of service via network vector with low attack complexity and no privileges or user interaction required.

This vulnerability is fixed in node-tar version 7.5.21. Users should upgrade to version 7.5.21 or later to remediate the issue. No other mitigation or workaround is documented. Patch status is not explicitly stated but the fix is included in version 7.5.21, so upgrading to this version or newer is the recommended remediation.