isaacs vulnerabilities

Products

• node-tar 14
• tar 12
• minimatch 4
• node-glob 2
• brace-expansion 1
• glob 1

Latest isaacs CVEs

Newest publication first

1. CVE-2026-118773 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

   Published 2026-10-29

   Medium·CVSS 6.3 EPSS 0.35%

   Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal...

2. CVE-2026-118764 minimatch: potential denial of service via globparts amplification

   Published 2026-10-29

   Medium·CVSS 6.9 EPSS 0.30%

   minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.....

3. CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

   Published 2026-08-13

   High·CVSS 7.5 EPSS 0.53%

   node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty membe...

4. CVE-2026-59871 node-tar: Process crash via PAX numeric path type confusion

   Published 2026-07-08

   High·CVSS 7.5 EPSS 0.64%

   node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught Type...

5. CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace

   Published 2026-07-08

   High·CVSS 8.7 EPSS 0.43%

   node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed...

6. CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input

   Published 2026-07-08

   Critical·CVSS 9.2 EPSS 0.58%

   node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to...

7. CVE-2026-59875 node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

   Published 2026-07-08

   Medium·CVSS 5.3 EPSS 0.35%

   node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exceptio...

8. CVE-2026-53655 node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

   Published 2026-06-22

   Medium·CVSS 6.9 EPSS 0.16%

   node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Pe...

9. CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath

   Published 2026-03-09

   High·CVSS 8.2 EPSS 0.29%

   node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd dur...

10. CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

    Published 2026-03-07

    High·CVSS 8.2 EPSS 0.51%

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar...

11. CVE-2026-27904 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

    Published 2026-02-26

    High·CVSS 7.5 EPSS 0.53%

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which...

12. CVE-2026-27903 minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

    Published 2026-02-26

    High·CVSS 7.5 EPSS 0.58%

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne() performs unbounded recursive backtracking when a glob pattern contains multiple non-adj...

13. CVE-2026-26996 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

    Published 2026-02-20

    High·CVSS 8.7 EPSS 0.58%

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact...

14. CVE-2026-26960 node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

    Published 2026-02-20

    High·CVSS 7.1 EPSS 0.33%

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as t...

15. CVE-2026-25547 Uncontrolled Resource Consumption in @isaacs/brace-expansion

    Published 2026-02-04

    Critical·CVSS 9.2 EPSS 0.54%

    @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated nume...

16. CVE-2026-24842 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

    Published 2026-01-28

    High·CVSS 8.2 EPSS 0.61%

    node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that b...

17. CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

    Published 2026-01-20

    Medium·CVSS 5.9 EPSS 0.26%

    node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS...

18. CVE-2026-23745 node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    Published 2026-01-16

    High·CVSS 8.2 EPSS 0.38%

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading t...

19. CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

    Published 2025-11-17

    High·CVSS 7.5 EPSS 3.1%

    Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names....

20. CVE-2025-64118 node-tar vulnerable to race condition leading to uninitialized memory exposure

    Published 2025-10-30

    Medium·CVSS 6.1 EPSS 0.13%

    node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

21. CVE-2024-28863 node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

    Published 2024-03-21

    Medium·CVSS 6.5 EPSS 0.93%

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl...

22. CVE-2018-20834 Arbitrary File Overwrite in tar

    Published 2019-04-30

    High·CVSS 7.5 EPSS 3.1%

    A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.