Description
node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
References (4)
Scores
CVSS v4
6.1
EPSS
0.0000
EPSS Percentile
0.2%
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-362
CWE-367
Status
published
Products (2)
isaacs/node-tar
= 7.5.1
npm/tar
7.5.1 - 7.5.2npm
Published
Oct 30, 2025
Tracked Since
Feb 18, 2026