node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade v8-13.6-develUpgrade npmUpgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Jul 30, 2026 | Jul 28, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-debuginfoUpgrade nodejs22-npmUpgrade nodejs22-docsUpgrade nodejs24Upgrade nodejs24-docsUpgrade nodejs24-debugsourceUpgrade nodejs22-full-i18nUpgrade nodejs22Upgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade v8-13.6-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs22-develUpgrade nodejs24-libsUpgrade nodejs22-libsUpgrade nodejs24-npmUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-debuginfo | Aug 18, 2026 | Jul 8, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Aug 19, 2026 | Aug 18, 2026 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade rh-podman-desktopUpgrade nodejs-npmUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nodejs24-npmUpgrade nodejs24-debugsourceUpgrade nodejs-libsUpgrade nodejs24-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs-packagingUpgrade nodejs24-docsUpgrade nodejs-packaging-bundlerNo solution existsUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade nodejs-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs22-debugsourceUpgrade nodejs24-libs | Jul 17, 2026 | Jul 8, 2026 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs24-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-full-i18nUpgrade v8-12.4-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs-npm | Jul 31, 2026 | Jul 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub