diff --git a/package-lock.json b/package-lock.json
index a18edea1..df446b00 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "tar",
-  "version": "7.5.20",
+  "version": "7.5.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tar",
-      "version": "7.5.20",
+      "version": "7.5.22",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
diff --git a/package.json b/package.json
index 9559da95..f19ece37 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter",
   "name": "tar",
   "description": "tar for node",
-  "version": "7.5.20",
+  "version": "7.5.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"
diff --git a/src/list.ts b/src/list.ts
index 8e236bf2..b52eafb9 100644
--- a/src/list.ts
+++ b/src/list.ts
@@ -30,13 +30,21 @@ export const filesFilter = (opt: TarOptions, files: string[]) => {
   )
   const filter = opt.filter
 
-  const mapHas = (file: string, r: string = ''): boolean => {
+  // limit recursion to 100 levels
+  const MAX = 100
+  const mapHas = (file: string, r: string = '', depth = 0): boolean => {
+    /* c8 ignore start - excessive caution */
+    if (depth >= MAX) {
+      map.set(file, false)
+      return false
+    }
+    /* c8 ignore stop */
     const root = r || parse(file).root || '.'
     let ret: boolean
     if (file === root) ret = false
     else {
       const m = map.get(file)
-      ret = m !== undefined ? m : mapHas(dirname(file), root)
+      ret = m !== undefined ? m : mapHas(dirname(file), root, depth + 1)
     }
 
     map.set(file, ret)
diff --git a/src/options.ts b/src/options.ts
index 84098fcc..4a388875 100644
--- a/src/options.ts
+++ b/src/options.ts
@@ -246,7 +246,9 @@ export interface TarOptions {
    * [MiniPass](http://npm.im/minipass)-based streams are designed for this use
    * case.
    */
-  transform?: (entry: ReadEntry) => ReadEntry
+  transform?: (
+    entry: ReadEntry,
+  ) => ReadEntry | null | undefined | false | 0 | ''
 
   /**
    * Call `chmod()` to ensure that extracted files match the entry's mode