node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00006.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Node-tar Project Subscribe
Node-tar Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Node-tar Project Subscribe
Node-tar Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-29xp-372q-xqph node-tar has a race condition leading to uninitialized memory exposure
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d cve-icon cve-icon
https://github.com/isaacs/node-tar/issues/445 cve-icon cve-icon
https://github.com/isaacs/node-tar/pull/446 cve-icon cve-icon
https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph cve-icon cve-icon
History

Fri, 31 Oct 2025 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Node-tar Project
Node-tar Project node-tar
Vendors & Products Node-tar Project
Node-tar Project node-tar

Thu, 30 Oct 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Oct 2025 18:00:00 +0000

Type Values Removed Values Added
Description node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
Title node-tar vulnerable to race condition leading to uninitialized memory exposure
Weaknesses CWE-362
CWE-367
References
Metrics cvssV4_0

{'score': 6.1, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-10-30T18:42:19.663Z

Reserved: 2025-10-27T15:26:14.128Z

Link: CVE-2025-64118

cve-icon Vulnrichment

Updated: 2025-10-30T18:42:14.810Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-30T18:15:33.673

Modified: 2025-11-04T15:41:56.843

Link: CVE-2025-64118

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-10-31T10:14:02Z

Weaknesses