isaacs

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

isaacs records in CISA KEV

No isaacs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tar 12 records HIGH Glob 1 record MEDIUM

Records

22 records

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

node-tar: Decompression/parse DoS via unlimited input

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-42688 CVE-2026-59874 · GHSA-8x88-c5mf-7j5w

node-tar: Negative tar entry size causes infinite loop in archive replace

HIGH 77

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00434 Published 2026-07-08 Partial fix · 7.5.18 CWE-835

TI-2026-51656 CVE-2026-73566 · GHSA-r292-9mhp-454m

Uncontrolled resource consumption in isaacs node-tar

HIGH 72

node-tar is a tar archive manipulation library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00531 Published 2026-08-13 Partial fix · 7.5.21 CWE-400

TI-2026-42686 CVE-2026-59871 · GHSA-w8wr-v893-vjvp

node-tar: Process crash via PAX numeric path type confusion

HIGH 72

node-tar is a tar archive manipulation library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00644 Published 2026-07-08 Partial fix · 7.5.18 CWE-704

TI-2026-24357 CVE-2026-31802 · GHSA-9ppj-qmqm-q256

node-tar Symlink Path Traversal via Drive-Relative Linkpath

HIGH 69

node-tar is a full-featured Tar for Node.js.

CVSS 4.0HIGH 8.2 Local No auth No interaction EPSS 0.00287 Published 2026-03-09 Partial fix · 7.5.11 CWE-22

TI-2026-23372 CVE-2026-29786 · GHSA-qffp-2rhf-9h96

node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

HIGH 69

node-tar is a full-featured Tar for Node.js.

CVSS 4.0HIGH 8.2 Local No auth User interaction EPSS 0.00511 Published 2026-03-07 Fixed in 7.5.10 CWE-22

TI-2026-20041 CVE-2026-24842 · GHSA-34x7-hfp2-rc4v

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

HIGH 69

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00608 Published 2026-01-28 Partial fix · 7.5.7 CWE-22

TI-2026-19118 CVE-2026-23745 · GHSA-8qq5-rm4j-mr97

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

HIGH 69

node-tar is a Tar for Node.js.

CVSS 4.0HIGH 8.2 Local No auth User interaction EPSS 0.00376 Published 2026-01-16 Partial fix · 7.5.3 CWE-22

TI-2026-22248 CVE-2026-27904 · GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

HIGH 66

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00525 Published 2026-02-26 Partial fix · 10.2.3, 9.0.7 +6 CWE-1333

TI-2026-22247 CVE-2026-27903 · GHSA-7r86-cg39-jmmj

minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

HIGH 66

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00576 Published 2026-02-26 Partial fix · 10.2.3, 9.0.7 +6 CWE-407

TI-2026-38696 CVE-2026-53655 · GHSA-vmf3-w455-68vh

node-tar applies PAX size override to intermediary GNU long-name/long-link headers…

MEDIUM 64

node-tar is a full-featured Tar for Node.js.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00156 Published 2026-06-22 Partial fix · 7.5.16 CWE-436

TI-2026-42689 CVE-2026-59875 · GHSA-gvwx-54wh-qm9j

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

MEDIUM 63

node-tar is a tar archive manipulation library for Node.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00354 Published 2026-07-08 Partial fix · 7.5.17 CWE-248

TI-2024-19062 CVE-2024-28863 · GHSA-f5x3-32g6-xq36

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

MEDIUM 62

node-tar is a Tar for Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00929 Published 2024-03-21 Partial fix · 6.2.1 CWE-400

TI-2025-39569 CVE-2025-64118 · GHSA-29xp-372q-xqph

node-tar vulnerable to race condition leading to uninitialized memory exposure

MEDIUM 60

node-tar is a Tar for Node.js.

CVSS 4.0MEDIUM 6.1 Local Low privileges User interaction EPSS 0.00134 Published 2025-10-30 Partial fix · 7.5.2 CWE-362

TI-2026-20656 CVE-2026-25547 · GHSA-7h2j-956f-4vf2

Uncontrolled Resource Consumption in @isaacs/brace-expansion

MEDIUM 46

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00538 Published 2026-02-04 Partial fix · 5.0.1 CWE-1333

TI-2026-21474 CVE-2026-26996 · GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

MEDIUM 44

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00577 Published 2026-02-20 Partial fix · 10.2.1, 9.0.6 +6 CWE-1333

TI-2025-40094 CVE-2025-64756 · GHSA-5j98-mcp5-4vw2

glob CLI: Command injection via -c/--cmd executes matches with shell:true

MEDIUM 40

Glob matches files using patterns the shell uses.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0309 Published 2025-11-17 Partial fix · 10.5.0, 11.1.0 CWE-78

TI-2018-14798 CVE-2018-20834 · GHSA-j44m-qm6p-hp7m

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).

LOW 39

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03145 Published 2019-04-30 Fixed in 4.4.2, 2.2.2 CWE-59

TI-2026-19292 CVE-2026-23950 · GHSA-r6q2-hw4h-h46w

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

LOW 38

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2026-01-20 Partial fix · 7.5.4 CWE-176

TI-2026-82695 CVE-2026-118764 · GHSA-g3hv-75wg-m249

Amplification in minimatch lets crafted globs exhaust CPU and memory

LOW 36

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00301 Published 2026-10-29 Partial fix · 11.0.1 CWE-405

TI-2026-21445 CVE-2026-26960 · GHSA-83g3-92jg-28cx

node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

LOW 33

node-tar is a full-featured Tar for Node.js.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00328 Published 2026-02-20 Partial fix · 7.5.8 CWE-22

TI-2026-82720 CVE-2026-118773 · GHSA-3g3m-2fjr-6pw4

Glob keeps traversing the filesystem after AbortSignal timeout

LOW 28

Glob matches files using patterns the shell uses.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0035 Published 2026-10-29 Partial fix · 14.0.2 CWE-400

Open these records in search →

Critical	2
High	14
Medium	6
Low	0
No CVSS	0