npm/tar CVE-2025-64118: medium 6.1, EPSS 0.13%
node-tar has a race condition leading to uninitialized memory exposure
Action: Upgrade tar to 7.5.2 or later.
npm i tar@7.5.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.5.1 | 7.5.2 | - |
Fixed versions
| 7.5.2 |
Sources
- osv: GHSA-29xp-372q-xqph
- nvd: CVE-2025-64118
- https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph
- https://github.com/isaacs/node-tar/issues/445
- https://github.com/isaacs/node-tar/pull/446
- https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d
- https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9
- https://github.com/isaacs/node-tar
CVE-2025-64118 · published · modified · JSON