GHSA-23hp-3jrh-7fpw critical
node-tar: Decompression/parse DoS via unlimited input
Affected range
SEMVER: introduced 0; fixed 7.5.19Fixed versions: 7.5.19
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
7.5.22
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
21 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-r292-9mhp-454m high
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
Affected range
SEMVER: introduced 0; fixed 7.5.21Fixed versions: 7.5.21
GHSA-8x88-c5mf-7j5w high
node-tar: Negative tar entry size causes infinite loop in archive replace
Affected range
SEMVER: introduced 0; fixed 7.5.18Fixed versions: 7.5.18
GHSA-r6q2-hw4h-h46w high
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
Affected range
SEMVER: introduced 0; fixed 7.5.4Fixed versions: 7.5.4
GHSA-8qq5-rm4j-mr97 high
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Affected range
SEMVER: introduced 0; fixed 7.5.3Fixed versions: 7.5.3
GHSA-qffp-2rhf-9h96 high
tar has Hardlink Path Traversal via Drive-Relative Linkpath
Affected range
SEMVER: introduced 0; fixed 7.5.10Fixed versions: 7.5.10
GHSA-9ppj-qmqm-q256 high
node-tar Symlink Path Traversal via Drive-Relative Linkpath
Affected range
SEMVER: introduced 0; fixed 7.5.11Fixed versions: 7.5.11
GHSA-83g3-92jg-28cx high
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
Affected range
SEMVER: introduced 0; fixed 7.5.8Fixed versions: 7.5.8
GHSA-34x7-hfp2-rc4v high
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Affected range
SEMVER: introduced 0; fixed 7.5.7Fixed versions: 7.5.7
GHSA-9r2w-394v-53qc high
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Affected range
SEMVER: introduced 3.0.0; fixed 4.4.16SEMVER: introduced 5.0.0; fixed 5.0.8SEMVER: introduced 6.0.0; fixed 6.1.7Fixed versions: 4.4.16, 5.0.8, 6.1.7
GHSA-3jfq-g458-7qm9 high
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Affected range
SEMVER: introduced 0; fixed 3.2.2SEMVER: introduced 4.0.0; fixed 4.4.14SEMVER: introduced 5.0.0; fixed 5.0.6SEMVER: introduced 6.0.0; fixed 6.1.1Fixed versions: 3.2.2, 4.4.14, 5.0.6, 6.1.1
GHSA-5955-9wpr-37jh high
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Affected range
SEMVER: introduced 0; fixed 4.4.18SEMVER: introduced 5.0.0; fixed 5.0.10SEMVER: introduced 6.0.0; fixed 6.1.9Fixed versions: 4.4.18, 5.0.10, 6.1.9
GHSA-qq89-hq3f-393p high
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Affected range
SEMVER: introduced 3.0.0; fixed 4.4.18SEMVER: introduced 5.0.0; fixed 5.0.10SEMVER: introduced 6.0.0; fixed 6.1.9Fixed versions: 4.4.18, 5.0.10, 6.1.9
GHSA-r628-mhmh-qjhw high
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Affected range
SEMVER: introduced 3.0.0; fixed 3.2.3SEMVER: introduced 4.0.0; fixed 4.4.15SEMVER: introduced 5.0.0; fixed 5.0.7SEMVER: introduced 6.0.0; fixed 6.1.2Fixed versions: 3.2.3, 4.4.15, 5.0.7, 6.1.2
GHSA-j44m-qm6p-hp7m high
Arbitrary File Overwrite in tar
Affected range
SEMVER: introduced 3.0.0; fixed 4.4.2SEMVER: introduced 0; fixed 2.2.2Fixed versions: 4.4.2, 2.2.2
GHSA-gfjr-3jmm-4g9v high
Symlink Arbitrary File Overwrite in tar
Affected range
SEMVER: introduced 0; fixed 2.0.0Fixed versions: 2.0.0
GHSA-w8wr-v893-vjvp moderate
node-tar: Process crash via PAX numeric path type confusion
Affected range
SEMVER: introduced 0; fixed 7.5.18Fixed versions: 7.5.18
GHSA-vmf3-w455-68vh moderate
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Affected range
SEMVER: introduced 0; fixed 7.5.16Fixed versions: 7.5.16
GHSA-gvwx-54wh-qm9j moderate
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
Affected range
SEMVER: introduced 0; fixed 7.5.17Fixed versions: 7.5.17
GHSA-29xp-372q-xqph moderate
node-tar has a race condition leading to uninitialized memory exposure
Affected range
SEMVER: introduced 7.5.1; fixed 7.5.2Fixed versions: 7.5.2
GHSA-f5x3-32g6-xq36 moderate
Denial of service while parsing a tar file due to lack of folders count validation
Affected range
SEMVER: introduced 0; fixed 6.2.1Fixed versions: 6.2.1