node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-devel | Aug 28, 2024 | Mar 21, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-libsUpgrade v8-10.2-develUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs20-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejs-develUpgrade nodejs20-develUpgrade nodejs-debuginfoUpgrade nodejs20Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade v8-11.3-develUpgrade nodejs20-docsUpgrade nodejs20-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-npmUpgrade nodejs20-npmUpgrade nodejs20-debuginfo | Feb 17, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade node-tar | May 15, 2025 | Mar 21, 2024 |
| F5 Big Ip | — | — | May 20, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docs | Oct 16, 2024 | Mar 21, 2024 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Mar 21, 2024 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundler | Sep 13, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs | Sep 17, 2024 | Mar 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 21, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub