node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packaging-bundler | Aug 28, 2024 | Mar 21, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs20-libsUpgrade v8-10.2-develUpgrade nodejs-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs-npmUpgrade nodejs20-npmUpgrade v8-11.3-develUpgrade nodejs20-docsUpgrade nodejs-debugsourceUpgrade nodejs20Upgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs20-devel | Feb 17, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade node-tar | May 15, 2025 | Mar 21, 2024 |
| F5 Big Ip | — | — | May 20, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-devel | Oct 16, 2024 | Mar 21, 2024 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Mar 21, 2024 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundler | Sep 13, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-devel | Sep 17, 2024 | Mar 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub