CVE-2025-64118
NoneCVSS
—
EPSS
0.1%
Published
Oct 30, 2025
CISA due date
—
The record
node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tar | 7.5.1 | No fix |
| npm | tar | 7.5.1 | 7.5.2 |
| Chainguard | actions-runner | 0 | 0 |
| Chainguard | actions-runner-compat | 0 | 0 |
| Chainguard | node-gyp | 0 | 12.0.0-r0 |
| Chainguard | npm | 0 | 0 |
| Chainguard | npm-doc | 0 | 0 |
| Chainguard | renovate | 0 | 42.26.3-r0 |
| Chainguard | renovate | 0 | 41.169.3-r0 |
| Wolfi | node-gyp | 0 | 12.0.0-r0 |
| Wolfi | npm | 0 | 0 |
| Wolfi | npm-doc | 0 | 0 |
| Wolfi | renovate | 0 | 42.26.3-r0 |
| Wolfi | renovate | 0 | 41.169.3-r0 |
Related vulnerabilities
- GHSA-29xp-372q-xqph node-tar has a race condition leading to uninitialized memory exposure Same vulnerability
- CVE-2026-53655 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers… Also affects tar
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects tar
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects tar
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects tar
- CVE-2026-26960 node-tar is a full-featured Tar for Node.js. Also affects tar