CVE-2026-73566

High

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 31st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 942; of 17,787 indexed, latest versions
Container images: 971; deployed by those charts
Fix available: 3 of 4; affected packages

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

Carried by container images the latest versions of 942 of 17,787 indexed charts deploy, on 971 images.

Affected package	Affected versions	Fixed in	Images
tarnpm	1.0.3, 2.2.1, 2.2.2, 4.0.2+34 more	7.5.21	971
node-tardeb	1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3+1 more	no fix listed	7
node-gypapk	13.0.0-r0	13.0.1-r1	1
npmapk	11.17.0-r0	12.0.1-r2	1

OSV records: CGA-63gq-6rq6-x5wc CGA-cppm-m8p8-rqr4 DEBIAN-CVE-2026-73566 GHSA-r292-9mhp-454m UBUNTU-CVE-2026-73566
Also known as: CGA-hm85-254c-g849, CGA-jp96-8764-w59g

Charts affected

942 by stars

Chart

Latest

Affected images

Radar Score

prowlerprowler-app

0.0.9

1 of 5 See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
prowlercloud/prowler-ui :5.31.1	79ee83c8e702	tar@7.5.1	7.5.21

Open the chart page →

8,203

psa-restricted-patcherpsa-restricted-patcher

0.10.1

1 of 1 See more

psa-restricted-patcher psa-restricted-patcher 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/psa-restricted-patcher :main	a53ef16b024a	tar@7.4.3	7.5.21

Open the chart page →

1,402

pumejwebapppumejnodejswebapp

0.1.0

1 of 1 See more

pumejwebapp pumejnodejswebapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
pumejlab/nodejs-webapp :latest	f563eabcb819	tar@6.1.15	7.5.21

Open the chart page →

1,164

laravel-octanerenoki-co

1.0.0

1 of 1 See more

laravel-octane renoki-co 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
quay.io/renokico/laravel-helm-demo :octane-0.6.0	cad83090c58f	tar@4.4.15	7.5.21

Open the chart page →

3,634

flamerlex

0.3.0

1 of 1 See more

2,449

rocketadminrocketadmin

1.0.42

1 of 1 See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
rocketadmin/rocketadmin :1.17.7	10955ef540b9	tar@7.5.13	7.5.21

Open the chart page →

5,508

kibanaromanow-helm-charts

1.7.1

1 of 1 See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
library/kibana :7.17.8	c5781ba340ef	tar@6.1.11	7.5.21

Open the chart page →

6,918

jellyseerrrtomik-helm-charts

0.0.1

1 of 1 See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/fallenbagel/jellyseerr :2.5.2	2a611369ad1d	tar@6.2.1	7.5.21

Open the chart page →

2,823

kyoorubxkube

0.1.10

1 of 9 See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/zoriya/kyoo_front :4.7.1	d7f76c9c65d9	tar@6.2.1	7.5.21

Open the chart page →

30,310

uptime-kumasb-helm-charts

0.4.0

1 of 1 See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.0.2	4c364ef96aad	tar@6.2.1	7.5.21

Open the chart page →

38,115

immichsecustor

2.0.5

1 of 1 See more

immich secustor 2.0.5

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-server :v3.2.1	2ab6a6273755	tar@7.5.15	7.5.21

Open the chart page →

3,011

karakeepself-hosters-by-night

2.5.1

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	tar@7.4.3	7.5.21

Open the chart page →

5,214

vuiseriohub

1.0.6

1 of 3 See more

11,545

wg-easyslybase-wg-easy

1.2.0

1 of 1 See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/wg-easy/wg-easy :15.4.0	0e7bc9d34e86	tar@7.5.16	7.5.21

Open the chart page →

725

speckle-serverspeckle

2.26.3

2 of 4 See more

speckle-server speckle 2.26.3

2 of the 4 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
speckle/speckle-preview-service :2.26.3	092384dba45d	tar@6.2.1	7.5.21
speckle/speckle-server :2.26.3	79f14a2bf931	tar@6.2.1	7.5.21

Open the chart page →

10,405

splice-helmsplice-helm

0.1.7

1 of 13 See more

splice-helm splice-helm 0.1.7

1 of the 13 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
jupyterhub/configurable-http-proxy :3.0.0	c36cf3cc1c99	tar@2.2.1	7.5.21

Open the chart page →

1,478

stackradar-scannerstackradar

0.3.0

1 of 1 See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/lockdep/stackradar-scanner :0.3.0	dd8a35d50c2d	tar@7.5.11	7.5.21

Open the chart page →

1,209

statsdstatsd-airflow-smd

0.1.19

1 of 1 See more

statsd statsd-airflow-smd 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
statsd/statsd :v0.8.6	dab129e74c25	tar@4.4.6	7.5.21

Open the chart page →

4,185

stornxstornx

1.1.1

1 of 9 See more

11,683

ackeesuda

0.2.1

1 of 1 See more

1,602

supabasesupabse

0.8.0

3 of 11 See more

supabase supabse 0.8.0

3 of the 11 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
supabase/postgres-meta :v0.96.6	a84cc713585e	tar@6.2.1	7.5.21
supabase/storage-api :v1.60.4	c8eb9858eafe	tar@7.5.11	7.5.21
supabase/studio :2026.08.03-sha-022b374	606aca9fdaa7	tar@7.5.20	7.5.21

Open the chart page →

18,213

switcher-apiswitcherapi

1.3.5

2 of 3 See more

switcher-api switcherapi 1.3.5

2 of the 3 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
trackerforce/switcher-api :latest	28ee0c4e0b88	tar@7.5.19	7.5.21
trackerforce/switcher-resolver-node :latest	67e2c261f7b4	tar@7.5.19	7.5.21

Open the chart page →

625

tenuretenure

1.0.6

1 of 2 See more

2,553

testhubteshub

0.1.4

1 of 3 See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
testhubio/testhub-frontend :on-prem	e86c2db53be8	tar@4.4.13	7.5.21

Open the chart page →

7,517

unitycatalogunitycatalog

0.0.2

1 of 4 See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	tar@6.2.1	7.5.21

Open the chart page →

12,137

taigaunxwares

2026.3.8

1 of 6 See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
taigaio/taiga-events :latest	92fc0822564f	tar@6.1.11	7.5.21

Open the chart page →

9,172

prerenderutkuozdemir

1.1.2

1 of 1 See more

prerender utkuozdemir 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
tvanro/prerender-alpine :6.4.0	6909015f0328	tar@4.4.19	7.5.21

Open the chart page →

2,660

restreamerutkuozdemir

1.1.0

1 of 1 See more

restreamer utkuozdemir 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
datarhei/restreamer :0.6.4	655e12f9eeed	tar@4.4.13	7.5.21

Open the chart page →

2,598

vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets

0.0.0-main

1 of 2 See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets :0.0.0-main	13e267ad7d94	tar@6.2.1	7.5.21

Open the chart page →

4,058

devportal-admin-uiveecode-platform

0.5.4

1 of 1 See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
veecode/devportal-admin-ui :0.4.30	c69fd286b489	tar@6.2.1	7.5.21

Open the chart page →

5,239

tdarrvhdirk

5.0.5

1 of 2 See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	tar@6.1.14	7.5.21

Open the chart page →

26,843

wachdwachd

0.4.37

1 of 1 See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	tar@7.5.11	7.5.21

Open the chart page →

1,270

wikiwenerme

2.2.0

1 of 2 See more

3,834

scrapoxywiremind

0.3.4

1 of 1 See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
wiremind/scrapoxy :latest	e7048929a676	tar@4.4.13	7.5.21

Open the chart page →

2,154

wraftwraft

0.1.12

1 of 9 See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	tar@6.2.1	7.5.21

Open the chart page →

10,131

discord-botxxczaki

0.27.7

1 of 2 See more

discord-bot xxczaki 0.27.7

1 of the 2 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
xxczaki/discord-bot :d088700d98c2e83381d034e584aed9412518933c	4271dc43f117	tar@7.5.19	7.5.21

Open the chart page →

475

youtubedl-materialyoutubedl-material

0.0.1

1 of 1 See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
tzahi12345/youtubedl-material :latest	2f943d584711	tar@6.1.11	7.5.21

Open the chart page →

9,832

qleverzazuko

0.7.0

1 of 2 See more

qlever zazuko 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/zazukoians/qlever-ui :v0.10.0	34c7b540a095	tar@7.4.3	7.5.21

Open the chart page →

2,947

crowdsec-web-uizekker6

0.51.0

1 of 1 See more

crowdsec-web-ui zekker6 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/theduffman85/crowdsec-web-ui :2026.8.3	bfadbab9a72c	tar@7.5.20	7.5.21

Open the chart page →

1,423

open5gsadaptivenetlab

1.0.3

1 of 3 See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui :v2.2.2	fda21b0a0344	tar@4.4.13	7.5.21

Open the chart page →

25,507

adeptia-automate-mcpadeptia-automate-mcp

1.0.0

2 of 2 See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	tar@7.4.3	7.5.21
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	tar@7.4.3	7.5.21

Open the chart page →

3,600

admin-portaladmin-web-portal

1.2.1

1 of 2 See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
soulou2019/node-server :latest	5e6ecfcc109e	tar@6.1.11	7.5.21

Open the chart page →

3,419

activepiecesadnoctem

0.5.0

1 of 1 See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
activepieces/activepieces :0.90.4	30c10a04fe3d	tar@6.2.1	7.5.21

Open the chart page →

1,055

lhciadnoctem

0.1.0

1 of 1 See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/adnoctem/lhci :1.0.1	19553e4b4033	tar@6.2.1	7.5.21

Open the chart page →

1,196

linkwardenadnoctem

0.5.1

1 of 2 See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	tar@7.5.11	7.5.21

Open the chart page →

3,577

outlineadnoctem

0.1.2

1 of 1 See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
outlinewiki/outline :1.10.1	832051f039b4	tar@7.5.15	7.5.21

Open the chart page →

1,213

uptime-kumaadnoctem

0.4.1

1 of 1 See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.5.4	917318f9d7be	tar@7.5.11	7.5.21

Open the chart page →

29,687

turborepo-remote-cacheadriantr

1.1.1

1 of 1 See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
ducktors/turborepo-remote-cache :latest	31ec9e83c844	tar@7.5.19	7.5.21

Open the chart page →

523

akto-mini-testingakto

1.45.7

1 of 5 See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay :1.49.4_latest	f1c5763d565e	tar@7.5.9	7.5.21

Open the chart page →

6,447

akto-source-code-analyserakto

0.1.5

1 of 3 See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-73566.

Container image	Digest	Package	Fixed in
aktosecurity/akto-puppeteer-replay :doom_latest	853e37321e6e	tar@6.2.1	7.5.21

Open the chart page →

4,881

Container images carrying it

971 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/flaresolverr/flaresolverr :v1.2.8	96f8c08c0c1b	tar@6.0.5	7.5.21	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	tar@6.2.1	7.5.21	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	tar@7.4.3	7.5.21	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	tar@7.4.3	7.5.21	1
ghcr.io/fpsacha/zomboid-panel :v1.0.66	05e16dd56cfb	tar@7.5.11	7.5.21	1
ghcr.io/gethomepage/homepage :v1.13.1	d8d784e50901	tar@7.5.11	7.5.21	1
ghcr.io/gethomepage/homepage :v2.3.0	f82027665453	tar@7.5.11	7.5.21	1
ghcr.io/glassflow/glassflow-etl-fe :v3.2.0	5eaad43bd6c5	tar@6.2.1	7.5.21	1
ghcr.io/harish2k01/portfolio-tracker :0.1.0	56efa3085895	tar@7.5.13	7.5.21	1
ghcr.io/hiteshnayak305/cors-proxy :1.2.0	e6ff0a131556	tar@7.4.3	7.5.21	1
ghcr.io/homarr-labs/homarr :v1.77.1	1f5b892aeef4	tar@7.5.15	7.5.21	1
ghcr.io/homarr-labs/homarr :v1.77.0	f23ad77a681b	tar@7.5.15	7.5.21	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	tar@6.2.1	7.5.21	1
ghcr.io/huscker/townsquare-backend :2.15.2	e106681e7673	tar@6.2.1	7.5.21	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	tar@7.4.3	7.5.21	1
ghcr.io/immich-app/immich-server :v3.2.1	2ab6a6273755	tar@7.5.15	7.5.21	1
ghcr.io/immich-app/immich-server :v3.1.0	b434cb9287ee	tar@7.5.16	7.5.21	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	tar@7.4.3	7.5.21	1
ghcr.io/jeboehm/fetchmailmgr :0.3.21	26c4691b28a4	tar@6.2.1	7.5.21	1
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	tar@7.4.3	7.5.21	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	tar@6.2.1	7.5.21	1
ghcr.io/jordan-dalby/bytestash :1.5.12	eb4f736b8cd4	tar@6.2.1	7.5.21	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	tar@6.1.11	7.5.21	1
ghcr.io/k10app/basicuserservice :latest	2ee057ad3bef	tar@6.1.11	7.5.21	1
ghcr.io/k10app/catalog :latest	639c980be0f1	tar@6.1.11	7.5.21	1
ghcr.io/k10app/order :latest	e1017d0dbd78	tar@6.1.13	7.5.21	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	tar@4.4.13	7.5.21	1
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	tar@6.2.1	7.5.21	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	tar@7.4.3	7.5.21	1
ghcr.io/karakeep-app/karakeep :0.33.2	b069e4307dec	tar@7.5.12	7.5.21	1
ghcr.io/karakeep-app/karakeep :0.26.0	f575a34ed3f8	tar@6.2.1	7.5.21	1
ghcr.io/kikplate/kikplate-web :main	34bbb61e8e42	tar@7.5.11	7.5.21	1
ghcr.io/kubedb/mongo-gui :latest	ee0354b7a57a	tar@6.1.11	7.5.21	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	tar@6.2.1	7.5.21	1
ghcr.io/kubiyabot/workflow-engine :v1.46.2	560a16a56d4e	tar@6.2.0	7.5.21	1
ghcr.io/leoquote/mergeable :latest	451706815103	tar@4.4.13	7.5.21	1
ghcr.io/leprechaun/lgtv2mqtt :latest	ac2e11c41ffb	tar@6.1.11	7.5.21	1
ghcr.io/lerentis/bitwarden-crd-operator :0.17.0	0a608c6ead85	tar@7.5.9	7.5.21	1
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	tar@7.5.11	7.5.21	1
ghcr.io/linuxserver/pairdrop :version-v1.11.2	3279d2d986c0	tar@7.5.2	7.5.21	1
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	tar@4.4.19	7.5.21	1
ghcr.io/lockdep/stackradar-scanner :0.3.0	dd8a35d50c2d	tar@7.5.11	7.5.21	1
ghcr.io/logtide-dev/logtide-backend :1.0.2	65463e02f887	tar@7.5.16	7.5.21	1
ghcr.io/logtide-dev/logtide-frontend :1.0.2	2a7da1451f86	tar@7.5.16	7.5.21	1
ghcr.io/m0nsterrr/hyperglass :v2.0.4	f7b5d20c5e42	tar@6.2.1	7.5.21	1
ghcr.io/m9sweeper/dash :1.6.0	2e27cdff8344	tar@6.1.15	7.5.21	1
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	tar@6.2.1	7.5.21	1
ghcr.io/manzil-infinity180/backend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	96c90cf82fdd	tar@6.2.1	7.5.21	1
ghcr.io/manzil-infinity180/frontend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	4e6394b715d9	tar@6.2.1	7.5.21	1
ghcr.io/marcuwynu23/express-typescript-sample :latest	9ef671b78ea8	tar@7.5.11	7.5.21	1