CVE-2025-64118
NPM Tar < 7.5.2 - Race Condition
Title source: ruleDescription
node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
Scores
EPSS
0.0001
EPSS Percentile
0.4%
Classification
CWE
CWE-367
CWE-362
Status
draft
Affected Products (1)
npm/tar
< 7.5.2npm
Timeline
Published
Oct 30, 2025
Tracked Since
Feb 18, 2026