Vulnerability index

Browse CVEs

13 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Tar HIGH 7.5
CVE-2026-59873

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, …

Fix: 7.5.19+
Fix from $1,950 2026-07-08
Tar HIGH 7.5
CVE-2026-59874

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256…

Fix: 7.5.18+
Fix from $1,950 2026-07-08
Tar HIGH 7.5
CVE-2026-59871

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to…

Fix: 7.5.18+
Fix from $1,950 2026-07-08
Tar MEDIUM 5.5
CVE-2026-53655

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) t…

Fix: 7.5.16+
Fix from $1,600 2026-06-22
Tar MEDIUM 5.5
CVE-2026-31802

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extrac…

Fix: 7.5.11+
Fix from $1,600 2026-03-10
Tar MEDIUM 6.3
CVE-2026-29786

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction …

Fix: 7.5.10+
Fix from $1,600 2026-03-07
Tar HIGH 7.1
CVE-2026-26960

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hard…

Fix: 7.5.8+
Fix from $1,950 2026-02-20
Tar HIGH 8.2
CVE-2026-24842

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path res…

Fix: 7.5.7+
Fix from $1,950 2026-01-28
Tar MEDIUM 5.9
CVE-2026-23950

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicod…

Fix: 7.5.4+
Fix from $1,600 2026-01-20
Tar MEDIUM 6.1
CVE-2026-23745

node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preser…

Fix: 7.5.3+
Fix from $1,600 2026-01-16
Glob HIGH 7.5
CVE-2025-64756

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command…

Fix: 10.5.0 / 11.1.0+
Fix from $1,950 2025-11-17
Tar MEDIUM 6.5
CVE-2024-28863

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An a…

Fix: 6.2.1+
Fix from $1,600 2024-03-21
Tar HIGH 7.5
CVE-2018-20834

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarb…

Fix: 2.2.2 / 4.4.2+
Fix from $1,950 2019-04-30