CVE-2025-64118

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
node-tar
bullseye (security)
6.0.5+ds1+~cs11.3.9-1+deb11u2
fixed
bullseye
6.0.5+ds1+~cs11.3.9-1+deb11u2
fixed
bookworm
6.1.13+~cs7.0.5-1
fixed
trixie
6.2.1+~cs7.0.8-1
fixed
forky
6.2.1+ds1+~cs6.1.13-1
fixed
sid
6.2.1+ds1+~cs6.1.13-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-tar
questing
needs-triage
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
Common Weakness Enumeration
References
https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d
https://github.com/isaacs/node-tar/issues/445
https://github.com/isaacs/node-tar/pull/446
https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph