CVE-2025-64118
Fixed in a distro release EPSS <1%CVSS 6.1
node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
Products: isaacs node-tar
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | tar | 7.5.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 0 |
| Chainguard | actions-runner-compat | 0 |
| Chainguard | node-gyp | 12.0.0-r0 |
| Chainguard | npm | 0 |
| Chainguard | npm-doc | 0 |
| Chainguard | renovate | 42.26.3-r0 |
| Chainguard | renovate | 41.169.3-r0 |
| Ubuntu 18.04 LTS | node-tar | no fix |
| Ubuntu 22.04 LTS | node-tar | no fix |
| Ubuntu 24.04 LTS | node-tar | no fix |
| Ubuntu 25.10 | node-tar | no fix |
| Ubuntu 26.04 LTS | node-tar | no fix |
| Ubuntu 26.10 | node-tar | no fix |
| Ubuntu Pro 14.04 LTS | node-tar | no fix |
| Ubuntu Pro 16.04 LTS | node-tar | no fix |
| Ubuntu Pro 20.04 LTS | node-tar | no fix |
| Wolfi | node-gyp | 12.0.0-r0 |
| Wolfi | npm | 0 |
| Wolfi | npm-doc | 0 |
| Wolfi | renovate | 42.26.3-r0 |
| Wolfi | renovate | 41.169.3-r0 |