PT-2025-44446 · Node-Tar · Node-Tar

Published 2025-10-30 · Updated 2026-03-29 · CVE-2025-64118

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.2

Description node-tar is a Tar for Node.js. When using the .t (also known as .list) function with the { sync: true } option to read tar entry contents, uninitialized memory contents may be returned if the tar file is modified on disk to a smaller size during the read operation.

Recommendations Update to version 7.5.2 or later.

Exploit

Fix

Time Of Check To Time Of Use

Race Condition

Weakness Enumeration

CWE-367

CWE-362

Related Identifiers

BDU:2026-01714

CVE-2025-64118

GHSA-29XP-372Q-XQPH

Affected Products

Node-Tar

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64118.json · Exploit
• https://osv.dev/vulnerability/GHSA-29xp-372q-xqph · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64118 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-64118 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01714 · Security Note
• https://ubuntu.com/security/CVE-2025-64118 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64118 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64118 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-64118 · Vendor Advisory
• https://github.com/isaacs/node-tar · Note
• https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph · Note
• https://github.com/isaacs/node-tar/issues/445 · Note
• https://github.com/isaacs/node-tar/pull/446 · Note
• https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d · Note
• https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9 · Note