The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended     header's size= record (and other PAX overrides) to the next header entry of any type, including     intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX     extended header (x) describes the next file entry, not the intermediary extension headers that may sit     between the x header and the file it annotates. Because node-tar lets the PAX size override the byte     length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to     every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed     tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single     crafted archive yields a different set of members under node-tar than under the reference tar tools. An     attacker can use this to hide a member from one parser while it is visible to another, which defeats     security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner     that lists entries with one library while a downstream step extracts with another) This vulnerability is     fixed in 7.5.16. (CVE-2026-53655)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-53655

medium Nessus Plugin ID 322160

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Jul 13, 2026, 1:10 PM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:N") Plugin Feed: 202607131310
Version 1.4 Jul 10, 2026, 10:18 AM CVSS metrics ("CVSSv2 score" set to 4.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607101018
Version 1.3 Jul 2, 2026, 3:38 PM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:N") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N") CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:U/RC:C") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202607021538
Version 1.2 Jun 24, 2026, 1:22 AM CVSS metrics ("CVSSv2 score" set to 5.8) Plugin metadata Detection (updated detection logic) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P") Plugin Feed: 202606240122
Version 1.1 Jun 23, 2026, 12:45 PM New Plugin Feed: 202606231245