Vulnerabilities

TI-2026-42686 CVE-2026-59871 · GHSA-w8wr-v893-vjvp

node-tar: Process crash via PAX numeric path type confusion

HIGH 72

node-tar is a tar archive manipulation library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00644 Published 2026-07-08 Partial fix · 7.5.18 CWE-704

TI-2026-42688 CVE-2026-59874 · GHSA-8x88-c5mf-7j5w

node-tar: Negative tar entry size causes infinite loop in archive replace

HIGH 77

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00434 Published 2026-07-08 Partial fix · 7.5.18 CWE-835

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

node-tar: Decompression/parse DoS via unlimited input

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-38696 CVE-2026-53655 · GHSA-vmf3-w455-68vh

node-tar applies PAX size override to intermediary GNU long-name/long-link headers…

MEDIUM 64

node-tar is a full-featured Tar for Node.js.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00156 Published 2026-06-22 Partial fix · 7.5.16 CWE-436

TI-2026-24357 CVE-2026-31802 · GHSA-9ppj-qmqm-q256

node-tar Symlink Path Traversal via Drive-Relative Linkpath

HIGH 69

node-tar is a full-featured Tar for Node.js.

CVSS 4.0HIGH 8.2 Local No auth No interaction EPSS 0.00287 Published 2026-03-09 Partial fix · 7.5.11 CWE-22

TI-2026-23372 CVE-2026-29786 · GHSA-qffp-2rhf-9h96

node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

HIGH 69

node-tar is a full-featured Tar for Node.js.

CVSS 4.0HIGH 8.2 Local No auth User interaction EPSS 0.00511 Published 2026-03-07 Fixed in 7.5.10 CWE-22

TI-2026-21445 CVE-2026-26960 · GHSA-83g3-92jg-28cx

node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

LOW 33

node-tar is a full-featured Tar for Node.js.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00328 Published 2026-02-20 Partial fix · 7.5.8 CWE-22

TI-2026-20041 CVE-2026-24842 · GHSA-34x7-hfp2-rc4v

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

HIGH 69

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00608 Published 2026-01-28 Partial fix · 7.5.7 CWE-22

TI-2026-19292 CVE-2026-23950 · GHSA-r6q2-hw4h-h46w

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

LOW 38

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2026-01-20 Partial fix · 7.5.4 CWE-176

TI-2026-19118 CVE-2026-23745 · GHSA-8qq5-rm4j-mr97

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

HIGH 69

node-tar is a Tar for Node.js.

CVSS 4.0HIGH 8.2 Local No auth User interaction EPSS 0.00376 Published 2026-01-16 Partial fix · 7.5.3 CWE-22

TI-2024-19062 CVE-2024-28863 · GHSA-f5x3-32g6-xq36

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

MEDIUM 62

node-tar is a Tar for Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00929 Published 2024-03-21 Partial fix · 6.2.1 CWE-400

TI-2018-14798 CVE-2018-20834 · GHSA-j44m-qm6p-hp7m

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).

LOW 39

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03145 Published 2019-04-30 Fixed in 4.4.2, 2.2.2 CWE-59

Vulnerabilities

Filters