How many CVEs have patched Unpack?

11 published CVEs changed Unpack in isaacs/node-tar, in 18 distinct patches totalling 247 changed lines, between 2021 and 2026.

What is the latest CVE that changed Unpack?

CVE-2026-59871 (node-tar: Process crash via PAX numeric path type confusion), published 2026-07-08, changed lines 175 of src/unpack.ts.

How does Unpack compare to the rest of isaacs/node-tar?

isaacs/node-tar has 17 CVEs with a located fix in total; 11 of them changed Unpack.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Patched Functions
Isaacs
Node Tar
Unpack

RadicalNotion.AI

We do not sell or share your personal information.

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Patched Functions
Isaacs
Node Tar
Unpack

Unpack in isaacs/node-tar: Patched by 11 CVEs

isaacs/node-tar

Class

2 files

Unpack

Name: Unpack in isaacs/node-tar: CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Defined in 2 files

Last patched July 8, 2026

CVEs

That changed this function

Distinct patches

Backports counted once

247

Lines changed

Added plus removed

2021–2026

Years

By CVE publication date

Overview

Unpack in isaacs/node-tar was changed by 11 published CVE fixes between 2021 and 2026, in 18 distinct patches that added or removed 247 lines in total.

The name occurs in 2 files: src/unpack.ts, lib/unpack.js.

isaacs/node-tar has 17 CVEs with a located fix in total, so 65% of them touched this function.

On this page

Overview
CVEs that patched it
Other functions in these files
Other hotspots in the repository
FAQ
References

CVEs that patched it

Every published CVE whose fix changed Unpack, newest first, with the lines each fix touched.

node-tar: Process crash via PAX numeric path type confusion
CVE-2026-59871 · src/unpack.ts · line 175 · +1 −1
High · CVSS 7.5
EPSS 0.6%2026-07-08
node-tar Symlink Path Traversal via Drive-Relative Linkpath
CVE-2026-31802 · src/unpack.ts · line 306 · +1 −1
High · CVSS 8.2
EPSS 0.2%2026-03-09
node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
CVE-2026-29786 · src/unpack.ts · lines 280–323 · +3 −3 in 2 hunks
High · CVSS 8.2
EPSS 0.4%2026-03-07
node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction
CVE-2026-26960 · src/unpack.ts · lines 338–928 · +59 −5 in 4 hunks
High · CVSS 7.1
EPSS 0.2%2026-02-20
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
CVE-2026-24842 · src/unpack.ts · lines 274–288 · +2 −1 in 2 hunks
High · CVSS 8.2
EPSS 0.6%2026-01-28
node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
CVE-2026-23745 · src/unpack.ts · lines 267–343 · +45 −26 in 2 hunks
High · CVSS 8.2
EPSS 0.4%2026-01-16
Denial of service while parsing a tar file due to lack of folders count validation
CVE-2024-28863 · lib/unpack.js · lines 248–278 · +15 −5 in 2 hunks
Medium · CVSS 6.5
EPSS 0.9%2024-03-21
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
CVE-2021-37713 · lib/unpack.js · lines 250–290 · +19 −3 in 3 hunks
High · CVSS 8.6
EPSS 1.3%2021-08-31
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
CVE-2021-37712 · lib/unpack.js · lines 182–585 · +29 −5 in 4 hunks
High · CVSS 8.6
EPSS 1.9%2021-08-31
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
CVE-2021-32804 · lib/unpack.js · lines 228–231 · +4 −5
High · CVSS 8.2
EPSS 15.1%2021-08-03
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
CVE-2021-32803 · lib/unpack.js · lines 417–430 · +14 −0
High · CVSS 8.2
EPSS 7.8%2021-08-03

Get an alert when the next CVE fix lands in isaacs/node-tar, with the patched functions.

Monitor node-tar CVEs

Other functions in these files

Functions in the same files that CVE fixes also changed.

1normalizelib/unpack.js1 CVEs · 3 patches2021
2getgidlib/unpack.js1 CVEs · 1 patches2024
3mkdirsrc/unpack.ts1 CVEs · 1 patches2026
4umasksrc/unpack.ts1 CVEs · 1 patches2026

Other hotspots in the repository

Functions in isaacs/node-tar changed by the most CVE fixes.

normalize1 CVEs · lib/unpack.js mkdir1 CVEs · src/unpack.ts reduce1 CVEs · src/pax.ts decNumber1 CVEs · src/header.ts abort1 CVEs · src/parse.ts write1 CVEs · src/parse.ts

All patched functions in isaacs/node-tar

Frequently asked questions

Common questions about CVE fixes to Unpack.

How many CVEs have patched Unpack?: 11 published CVEs changed Unpack in isaacs/node-tar, in 18 distinct patches totalling 247 changed lines, between 2021 and 2026.
What is the latest CVE that changed Unpack?: CVE-2026-59871 (node-tar: Process crash via PAX numeric path type confusion), published 2026-07-08, changed lines 175 of src/unpack.ts.
How does Unpack compare to the rest of isaacs/node-tar?: isaacs/node-tar has 17 CVEs with a located fix in total; 11 of them changed Unpack.
What do the line numbers refer to?: Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

References

src/unpack.ts on GitHub (opens in a new tab)
lib/unpack.js on GitHub (opens in a new tab)
All patched functions in isaacs/node-tar
Patched functions directory

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track isaacs/node-tar CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing