node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docs | Aug 28, 2024 | Mar 21, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-full-i18nUpgrade nodejs20-libsUpgrade nodejs-libsUpgrade nodejs20-debugsourceUpgrade nodejs-develUpgrade v8-10.2-develUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs20-npmUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs20-develUpgrade nodejs20-docsUpgrade nodejs-docsUpgrade v8-11.3-develUpgrade nodejs-debuginfoUpgrade nodejs20 | Feb 17, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade node-tar | May 15, 2025 | Mar 21, 2024 |
| F5 Big Ip | — | — | May 20, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npm | Oct 16, 2024 | Mar 21, 2024 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Mar 21, 2024 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundler | Sep 13, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs | Sep 17, 2024 | Mar 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 21, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub