Vendor

    Isaacs

    20 known vulnerabilities in products by Isaacs, 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Isaacs
    HighCVE-2025-64756

    glob CLI: Command injection via -c/--cmd executes matches with shell:true

    also in 3 other products

    		7.5
    HighCVE-2018-20834

    isaacs tar: security vulnerability

    		7.5
    CriticalCVE-2026-59873

    node-tar: Decompression/parse DoS via unlimited input

    also in 2 other products

    		7.5
    HighCVE-2026-59871

    node-tar: Process crash via PAX numeric path type confusion

    also in 1 other product

    		7.5
    HighCVE-2026-73566

    Isaacs Node-tar: Uncontrolled Resource Consumption

    also in 1 other product

    		7.5
    CriticalCVE-2026-25547

    Uncontrolled Resource Consumption in @isaacs/brace-expansion

    also in 1 other product

    		—
    HighCVE-2026-26996

    minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

    also in 3 other products

    		7.5
    HighCVE-2026-59874

    node-tar: Negative tar entry size causes infinite loop in archive replace

    also in 2 other products

    		7.5
    HighCVE-2026-24842

    node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

    also in 1 other product

    		8.2
    HighCVE-2026-27903

    Isaacs Minimatch: Inefficient Algorithmic Complexity

    also in 4 other products

    		7.5
    HighCVE-2026-29786

    node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

    also in 3 other products

    		6.3
    HighCVE-2026-27904

    minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

    also in 5 other products

    		7.5
    MediumCVE-2024-28863

    Isaacs Node-tar: Allocation of Resources Without Limits or Throttling

    also in 1 other product

    		6.5
    HighCVE-2026-23745

    Isaacs Node-tar: Path Traversal

    also in 1 other product

    		6.1
    HighCVE-2026-23950

    node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

    also in 2 other products

    		8.8
    HighCVE-2026-31802

    node-tar Symlink Path Traversal via Drive-Relative Linkpath

    also in 3 other products

    		5.5
    HighCVE-2026-26960

    Isaacs Node-tar: Path Traversal

    also in 4 other products

    		7.1
    MediumCVE-2026-53655

    Isaacs Node-tar: Interpretation Conflict

    also in 1 other product

    		5.5
    MediumCVE-2026-59875

    node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

    also in 1 other product

    		5.3
    MediumCVE-2025-64118

    node-tar vulnerable to race condition leading to uninitialized memory exposure

    		—

    Products

    Products by Isaacs
    Node-tar140
    isaacs tar120
    Minimatch30