HIGH7.5npm
GHSA-23hp-3jrh-7fpw· CVE-2026-59873node-tar: Decompression/parse DoS via unlimited input
Modified: 9/10/2026
package
npm/tar
pkg:npm/tar
MEDIUMnpm
GHSA-29xp-372q-xqph· CVE-2025-64118node-tar has a race condition leading to uninitialized memory exposure
Modified: 9/10/2026
HIGH8.2npm
GHSA-34x7-hfp2-rc4v· CVE-2026-24842node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Modified: 9/10/2026
HIGH8.2npm
GHSA-3jfq-g458-7qm9· CVE-2021-32804Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Modified: 7/8/2026
HIGH8.2npm
GHSA-5955-9wpr-37jh· CVE-2021-37713Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Modified: 7/8/2026
HIGH7.1npm
GHSA-83g3-92jg-28cx· CVE-2026-26960Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
Modified: 9/10/2026
HIGHnpm
GHSA-8qq5-rm4j-mr97· CVE-2026-23745node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Modified: 9/10/2026
HIGH7.5npm
GHSA-8x88-c5mf-7j5w· CVE-2026-59874node-tar: Negative tar entry size causes infinite loop in archive replace
Modified: 9/10/2026
HIGHnpm
GHSA-9ppj-qmqm-q256· CVE-2026-31802node-tar Symlink Path Traversal via Drive-Relative Linkpath
Modified: 9/10/2026
HIGH8.2npm
GHSA-9r2w-394v-53qc· CVE-2021-37701Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Modified: 7/8/2026
MEDIUM6.5npm
GHSA-f5x3-32g6-xq36· CVE-2024-28863Denial of service while parsing a tar file due to lack of folders count validation
Modified: 9/10/2026
HIGH7.5npm
GHSA-gfjr-3jmm-4g9v· CVE-2015-8860Symlink Arbitrary File Overwrite in tar
Modified: 11/8/2023
MEDIUM5.3npm
GHSA-gvwx-54wh-qm9j· CVE-2026-59875node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
Modified: 9/10/2026
HIGH7.5npm
GHSA-j44m-qm6p-hp7m· CVE-2018-20834Arbitrary File Overwrite in tar
Modified: 11/29/2023
HIGHnpm
GHSA-qffp-2rhf-9h96· CVE-2026-29786tar has Hardlink Path Traversal via Drive-Relative Linkpath
Modified: 9/10/2026
HIGH8.2npm
GHSA-qq89-hq3f-393p· CVE-2021-37712Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Modified: 7/8/2026
HIGH7.5npm
GHSA-r292-9mhp-454m· CVE-2026-73566node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
Modified: 9/10/2026
HIGH8.2npm
GHSA-r628-mhmh-qjhw· CVE-2021-32803Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Modified: 7/8/2026
HIGH8.8npm
GHSA-r6q2-hw4h-h46w· CVE-2026-23950Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
Modified: 9/10/2026
MEDIUMnpm
GHSA-vmf3-w455-68vh· CVE-2026-53655node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Modified: 9/10/2026
MEDIUM5.3npm
GHSA-w8wr-v893-vjvp· CVE-2026-59871node-tar: Process crash via PAX numeric path type confusion
Modified: 9/10/2026