node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packaging-bundler | Aug 28, 2024 | Mar 21, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-docsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs20-develUpgrade nodejs20-npmUpgrade nodejs-full-i18nUpgrade nodejs20Upgrade nodejs-npmUpgrade v8-11.3-develUpgrade nodejs-libs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs-libsUpgrade nodejs20-debugsourceUpgrade nodejs-develUpgrade nodejs20-libsUpgrade v8-10.2-develUpgrade nodejs | Feb 17, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade node-tar | May 15, 2025 | Mar 21, 2024 |
| F5 Big Ip | — | — | May 20, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Oct 16, 2024 | Mar 21, 2024 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Mar 21, 2024 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundler | Sep 13, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfo | Sep 17, 2024 | Mar 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub