CVE-2026-73566 (HIGH): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-73566](https://avd.aquasec.com/nvd/cve-2026-73566) | `HIGH` | `tar` | `7.5.16` | `7.5.21` | `2026-08-13T18:18:19.25Z` | `2026-08-22T10:18:29.036623362Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/nodejs:latest` | `public.ecr.aws/lambda/nodejs@sha256:1ff82da6fcff5cb4d0518505aeba477acab4d5bc230e257ac3d0450a77fbc169` |
| `public.ecr.aws/lambda/nodejs:24` | `public.ecr.aws/lambda/nodejs@sha256:1ff82da6fcff5cb4d0518505aeba477acab4d5bc230e257ac3d0450a77fbc169` |
| `public.ecr.aws/lambda/nodejs:22` | `public.ecr.aws/lambda/nodejs@sha256:8e26dc1314af70609939e524f4474a3043a945bfe862779ef408deb2962ce945` |

---

## Description

> node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.

---

### Remediation Steps
- Update the affected package `tar` from version `7.5.16` to `7.5.21`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Start with the Docker image definitions and build process for the Lambda Node.js images listed in the issue, then check where the installed tar package version comes from. Update the affected package to 7.5.21, rebuild the listed images, and verify that the vulnerability scan no longer reports CVE-2026-73566.

Written by the indexing model from the issue text.