{"id":"EUVD-2025-37034","enisaUuid":"c60df3e3-aade-3c24-b786-b2b3b54621f8","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.","datePublished":"Oct 30, 2025, 5:50:20 PM","dateUpdated":"Oct 30, 2025, 6:42:19 PM","baseScore":6.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H","references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph\nhttps://github.com/isaacs/node-tar/issues/445\nhttps://github.com/isaacs/node-tar/pull/446\nhttps://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d\n","aliases":"CVE-2025-64118\nGHSA-29xp-372q-xqph\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"a6acad90-925e-37f7-8e1c-8b2a293ca45a","product":{"name":"node-tar","vendor":{"name":"isaacs"}},"product_version":"\u003d 7.5.1"}],"enisaIdVendor":[{"id":"a66cf803-0944-31d0-970d-b6d18284a7ca","vendor":{"name":"isaacs"}}],"enisaIdVulnerability":[{"id":"9deb7fa3-614d-39df-a80d-d8c95bf2f345","vulnerability":{"id":"GHSA-29xp-372q-xqph","description":"node-tar has a race condition leading to uninitialized memory exposure","datePublished":"Oct 30, 2025, 5:13:17 PM","dateUpdated":"Oct 30, 2025, 7:53:34 PM","baseScore":0.0,"references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-64118\nhttps://github.com/isaacs/node-tar/issues/445\nhttps://github.com/isaacs/node-tar/pull/446\nhttps://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d\nhttps://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9\nhttps://github.com/isaacs/node-tar\n","enisa_id":"EUVD-2025-37034\n","aliases":"GHSA-29xp-372q-xqph\nCVE-2025-64118\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ac120b2d-19e8-3a92-bc7a-46085f01b742","vulnerability":{"id":"CVE-2025-64118","description":"node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.","datePublished":"Oct 30, 2025, 5:50:20 PM","dateUpdated":"Oct 30, 2025, 6:42:19 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H","references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph\nhttps://github.com/isaacs/node-tar/issues/445\nhttps://github.com/isaacs/node-tar/pull/446\nhttps://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d\n","enisa_id":"EUVD-2025-37034\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Oct 29, 2026, 7:19:57 AM","vulnerabilityProduct":[{"id":"01cdf197-9baf-3690-a3f6-e81eef5deb5e","product":{"name":"node-tar","vendor":{"name":"isaacs"}},"product_version":"\u003d 7.5.1"}],"vulnerabilityVendor":[{"id":"95477ca3-f9f5-3ea4-8265-59614b17eea7","vendor":{"name":"isaacs"}}]}}],"enisaIdAdvisory":[]}