Filtered by vendor Node-tar Project
Subscriptions
Filtered by product Node-tar
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-28863 | 3 Isaacs, Node-tar Project, Redhat | 6 Tar, Node-tar, Enterprise Linux and 3 more | 2025-12-16 | 6.5 Medium |
| node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders. | ||||
| CVE-2025-64118 | 1 Node-tar Project | 1 Node-tar | 2025-11-04 | N/A |
| node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2. | ||||
Page 1 of 1.