node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-full-i18n | Aug 28, 2024 | Mar 21, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-debugsourceUpgrade nodejs-develUpgrade v8-10.2-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs20-full-i18nUpgrade nodejs20-libsUpgrade nodejs20Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs20-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs20-docsUpgrade nodejs20-debuginfoUpgrade v8-11.3-develUpgrade nodejs-npmUpgrade nodejs20-npmUpgrade nodejs20-develUpgrade nodejs-debuginfo | Feb 17, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade node-tar | May 15, 2025 | Mar 21, 2024 |
| F5 Big Ip | — | — | May 20, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Oct 16, 2024 | Mar 21, 2024 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Mar 21, 2024 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18n | Sep 13, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npm | Sep 17, 2024 | Mar 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub