CVE-2025-64118 | THREATINT

Description

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

PUBLISHED Reserved 2025-10-27 | Published 2025-10-30 | Updated 2025-10-30 | Assigner GitHub_M

MEDIUM: 6.1CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

Problem types

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Product status

= 7.5.1

affected

References

github.com/...de-tar/security/advisories/GHSA-29xp-372q-xqph

github.com/isaacs/node-tar/issues/445

github.com/isaacs/node-tar/pull/446

github.com/...ommit/5330eb04bc43014f216e5c271b40d5c00d45224d

cve.org (CVE-2025-64118)

nvd.nist.gov (CVE-2025-64118)

Download JSON