npm node-tar vulnerabilities

Latest npm node-tar CVEs

Newest publication first

1. CVE-2024-28863 node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

   Published 2024-03-21

   Medium·CVSS 6.5 EPSS 0.93%

   node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl...

2. CVE-2021-37713 Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

   Published 2021-08-31

   High·CVSS 8.6 EPSS 1.3%

   The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not e...

3. CVE-2021-37712 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

   Published 2021-08-31

   High·CVSS 8.6 EPSS 1.9%

   The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This...

4. CVE-2021-37701 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

   Published 2021-08-31

   High·CVSS 8.6 EPSS 3.3%

   The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This i...

5. CVE-2021-32804 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

   Published 2021-08-03

   High·CVSS 8.1 EPSS 15.1%

   The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into rel...

6. CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

   Published 2021-08-03

   High·CVSS 8.1 EPSS 7.8%

   The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not ext...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.