Skip to main content
cve.nowby Sazabi
← npm
npmPackage

tar

21 known vulnerabilities (1 critical, 13 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
7.5.22 (Jul 24, 2026): no advisory affects it
Newest unaffected release
7.5.22 (Jul 24, 2026), the latest release
Advisories
21 · 1 critical, 13 high, 5 medium
Weekly downloads
119.3M
Dependents
24.3K
Releases
153 since 0.0.1 (Nov 20, 2011)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 21 advisoriesShow fewer advisories
  • CVE-2025-64118
    Affects 7.5.1 (7.5.2 is outside it)
  • CVE-2024-28863
    Affects 0.0.1 to 6.2.0 (6.2.1 is outside it)
  • CVE-2021-37713
    Affects 0.0.1 to 4.4.17 (4.4.18 is outside it); 5.0.0 to 5.0.9 (5.0.10 is outside it); 6.0.0 to 6.1.8 (6.1.9 is outside it)
  • CVE-2021-37712
    Affects 3.0.0 to 4.4.17 (4.4.18 is outside it); 5.0.0 to 5.0.9 (5.0.10 is outside it); 6.0.0 to 6.1.8 (6.1.9 is outside it)
  • CVE-2021-37701
    Affects 3.0.0 to 4.4.15 (4.4.16 is outside it); 5.0.0 to 5.0.7 (5.0.8 is outside it); 6.0.0 to 6.1.6 (6.1.7 is outside it)
  • CVE-2021-32804
    Affects 0.0.1 to 3.2.1 (3.2.2 is outside it); 4.0.0 to 4.4.13 (4.4.14 is outside it); 5.0.0 to 5.0.5 (5.0.6 is outside it); 6.0.0 to 6.1.0 (6.1.1 is outside it)
  • CVE-2021-32803
    Affects 3.0.0 to 3.2.2 (3.2.3 is outside it); 4.0.0 to 4.4.14 (4.4.15 is outside it); 5.0.0 to 5.0.6 (5.0.7 is outside it); 6.0.0 to 6.1.1 (6.1.2 is outside it)
  • CVE-2018-20834
    Affects 0.0.1 to 2.2.1 (2.2.2 is outside it); 3.0.0 to 4.4.1 (4.4.2 is outside it)
  • CVE-2015-8860
    Affects 0.0.1 to 1.0.3 (2.0.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 21

  • node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

    Affected: fixed in 7.5.21.

    Fixed in 7.5.21 (released Jul 21, 2026, 23 days before disclosure).

    The latest release, 7.5.22, is not affected.

    56% of tar downloads last week were affected versions (74.8M).

  • CVE-2026-59871Medium 5.3

    node-tar: Process crash via PAX numeric path type confusion

    Affected: fixed in 7.5.18.

    Fixed in 7.5.18 (released Jun 27, 2026, 11 days before disclosure).

    The latest release, 7.5.22, is not affected.

    51% of tar downloads last week were affected versions (69.2M).

  • node-tar: Negative tar entry size causes infinite loop in archive replace

    Affected: fixed in 7.5.18.

    Fixed in 7.5.18 (released Jun 27, 2026, 11 days before disclosure).

    The latest release, 7.5.22, is not affected.

    51% of tar downloads last week were affected versions (69.2M).

  • CVE-2026-59873Critical 9.2

    node-tar: Decompression/parse DoS via unlimited input

    Affected: fixed in 7.5.19.

    Fixed in 7.5.19 (released Jun 27, 2026, 11 days before disclosure).

    The latest release, 7.5.22, is not affected.

    52% of tar downloads last week were affected versions (69.2M).

  • CVE-2026-59875Medium 5.3

    node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

    Affected: fixed in 7.5.17.

    Fixed in 7.5.17 (released Jun 25, 2026, 13 days before disclosure).

    The latest release, 7.5.22, is not affected.

    51% of tar downloads last week were affected versions (69M).

  • CVE-2026-53655Medium 6.9

    node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file…

    Affected: fixed in 7.5.16.

    Fixed in 7.5.16 (released Jun 1, 2026, 21 days before disclosure).

    The latest release, 7.5.22, is not affected.

    48% of tar downloads last week were affected versions (64.3M).

  • node-tar Symlink Path Traversal via Drive-Relative Linkpath

    Affected: fixed in 7.5.11.

    Fixed in 7.5.11 (released Mar 9, 2026, the day of disclosure).

    The latest release, 7.5.22, is not affected.

    41% of tar downloads last week were affected versions (54.6M).

  • node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

    Affected: fixed in 7.5.10.

    Fixed in 7.5.10 (released Mar 4, 2026, 3 days before disclosure).

    The latest release, 7.5.22, is not affected.

    41% of tar downloads last week were affected versions (54.5M).

  • node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

    Affected: fixed in 7.5.8.

    Fixed in 7.5.8 (released Feb 16, 2026, 4 days before disclosure).

    The latest release, 7.5.22, is not affected.

    40% of tar downloads last week were affected versions (53.5M).

  • node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

    Affected: fixed in 7.5.7.

    Fixed in 7.5.7 (released Jan 27, 2026, 1 day before disclosure).

    The latest release, 7.5.22, is not affected.

    38% of tar downloads last week were affected versions (50.8M).

  • node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

    Affected: fixed in 7.5.4.

    Fixed in 7.5.4 (released Jan 19, 2026, 1 day before disclosure).

    The latest release, 7.5.22, is not affected.

    38% of tar downloads last week were affected versions (50.5M).

  • node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    Affected: fixed in 7.5.3.

    Fixed in 7.5.3 (released Jan 16, 2026, the day of disclosure).

    The latest release, 7.5.22, is not affected.

    38% of tar downloads last week were affected versions (50.4M).

  • CVE-2025-64118Medium 6.1

    node-tar vulnerable to race condition leading to uninitialized memory exposure

    Affected: from 7.5.1, fixed in 7.5.2.

    Fixed in 7.5.2 (released Oct 30, 2025, the day of disclosure).

    The latest release, 7.5.22, is not affected.

    2.3% of tar downloads last week were affected versions (3.1M).

  • CVE-2024-28863Medium 6.5

    node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

    Affected: fixed in 6.2.1.

    Fixed in 6.2.1 (released Mar 21, 2024, the day of disclosure).

    The latest release, 7.5.22, is not affected.

    7% of tar downloads last week were affected versions (9.4M).

  • Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

    Affected: fixed in 4.4.18; from 5.0.0, fixed in 5.0.10; from 6.0.0, fixed in 6.1.9.

    Fixed in 4.4.18 (released Aug 19, 2021, 12 days before disclosure), 5.0.10 (released Aug 19, 2021, 12 days before disclosure) and 6.1.9 (released Aug 19, 2021, 12 days before disclosure).

    The latest release, 7.5.22, is not affected.

    2.3% of tar downloads last week were affected versions (3.1M).

Show all 21 advisoriesShow fewer advisories

  • Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

    Affected: from 3.0.0, fixed in 4.4.18; from 5.0.0, fixed in 5.0.10; from 6.0.0, fixed in 6.1.9.

    Fixed in 4.4.18 (released Aug 19, 2021, 12 days before disclosure), 5.0.10 (released Aug 19, 2021, 12 days before disclosure) and 6.1.9 (released Aug 19, 2021, 12 days before disclosure).

    The latest release, 7.5.22, is not affected.

    1.1% of tar downloads last week were affected versions (1.5M).

  • Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

    Affected: from 3.0.0, fixed in 4.4.16; from 5.0.0, fixed in 5.0.8; from 6.0.0, fixed in 6.1.7.

    Fixed in 4.4.16 (released Aug 9, 2021, 22 days before disclosure), 5.0.8 (released Aug 9, 2021, 22 days before disclosure) and 6.1.7 (released Aug 9, 2021, 22 days before disclosure).

    The latest release, 7.5.22, is not affected.

    1.1% of tar downloads last week were affected versions (1.5M).

  • Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

    Affected: fixed in 3.2.2; from 4.0.0, fixed in 4.4.14; from 5.0.0, fixed in 5.0.6; from 6.0.0, fixed in 6.1.1.

    Fixed in 3.2.2 (released Jul 23, 2021, 11 days before disclosure), 4.4.14 (released Jul 23, 2021, 11 days before disclosure), 5.0.6 (released Jul 23, 2021, 11 days before disclosure) and 1 other version.

    The latest release, 7.5.22, is not affected.

    2.2% of tar downloads last week were affected versions (3M).

  • Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

    Affected: from 3.0.0, fixed in 3.2.3; from 4.0.0, fixed in 4.4.15; from 5.0.0, fixed in 5.0.7; from 6.0.0, fixed in 6.1.2.

    Fixed in 3.2.3 (released Jul 26, 2021, 8 days before disclosure), 4.4.15 (released Jul 26, 2021, 8 days before disclosure), 5.0.7 (released Jul 26, 2021, 8 days before disclosure) and 1 other version.

    The latest release, 7.5.22, is not affected.

    1.1% of tar downloads last week were affected versions (1.4M).

  • A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).

    Affected: from 3.0.0, fixed in 4.4.2; fixed in 2.2.2.

    Fixed in 2.2.2 (released May 15, 2019, 15 days after disclosure) and 4.4.2 (released Apr 30, 2018, 365 days before disclosure).

    The latest release, 7.5.22, is not affected.

    0.3% of tar downloads last week were affected versions (417.1K).

  • The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

    Affected: fixed in 2.0.0.

    Fixed in 2.0.0 (released Mar 27, 2015, 668 days before disclosure).

    The latest release, 7.5.22, is not affected.

    <0.1% of tar downloads last week were affected versions (47.8K).