diff --git a/.changeset/calm-elephants-kiss.md b/.changeset/calm-elephants-kiss.md
new file mode 100644
index 0000000000..063ff00e26
--- /dev/null
+++ b/.changeset/calm-elephants-kiss.md
@@ -0,0 +1,6 @@
+---
+'@backstage/backend-common': patch
+'@backstage/cli': patch
+---
+
+bump node-tar version to the latest
diff --git a/packages/backend-common/package.json b/packages/backend-common/package.json
index 51ef8128e7..3f08b42aab 100644
--- a/packages/backend-common/package.json
+++ b/packages/backend-common/package.json
@@ -62,7 +62,7 @@
     "raw-body": "^2.4.1",
     "selfsigned": "^1.10.7",
     "stoppable": "^1.1.0",
-    "tar": "^6.0.5",
+    "tar": "^6.1.2",
     "unzipper": "^0.10.11",
     "winston": "^3.2.1",
     "yn": "^4.0.0"
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 91bb94d43b..254a60c9ca 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -104,7 +104,7 @@
     "start-server-webpack-plugin": "^2.2.5",
     "style-loader": "^1.2.1",
     "sucrase": "^3.18.2",
-    "tar": "^6.0.1",
+    "tar": "^6.1.2",
     "terser-webpack-plugin": "^1.4.3",
     "ts-loader": "^8.0.17",
     "typescript": "^4.0.3",
diff --git a/yarn.lock b/yarn.lock
index 1be3dedc16..1fb6904c58 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -24737,10 +24737,10 @@ tar@^4, tar@^4.4.12, tar@^4.4.2:
     safe-buffer "^5.1.2"
     yallist "^3.0.3"
 
-tar@^6.0.1, tar@^6.0.2, tar@^6.0.5, tar@^6.1.0:
-  version "6.1.0"
-  resolved "https://registry.npmjs.org/tar/-/tar-6.1.0.tgz#d1724e9bcc04b977b18d5c573b333a2207229a83"
-  integrity sha512-DUCttfhsnLCjwoDoFcI+B2iJgYa93vBnDUATYEeRx6sntCTdN01VnqsIuTlALXla/LWooNg0yEGeB+Y8WdFxGA==
+tar@^6.0.2, tar@^6.1.0, tar@^6.1.2:
+  version "6.1.2"
+  resolved "https://registry.npmjs.org/tar/-/tar-6.1.2.tgz#1f045a90a6eb23557a603595f41a16c57d47adc6"
+  integrity sha512-EwKEgqJ7nJoS+s8QfLYVGMDmAsj+StbI2AM/RTHeUSsOw6Z8bwNBRv5z3CY0m7laC5qUAqruLX5AhMuc5deY3Q==
   dependencies:
     chownr "^2.0.0"
     fs-minipass "^2.0.0"