Product by Isaacs
Node-tar
14 known vulnerabilities in Node-tar (Isaacs), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-59873 | node-tar: Decompression/parse DoS via unlimited input | 7.5 | |
| High | CVE-2026-59871 | node-tar: Process crash via PAX numeric path type confusion | 7.5 | |
| High | CVE-2026-73566 | Isaacs Node-tar: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2026-59874 | node-tar: Negative tar entry size causes infinite loop in archive replace | 7.5 | |
| High | CVE-2026-24842 | node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal | 8.2 | |
| High | CVE-2026-29786 | node-tar: Hardlink Path Traversal via Drive-Relative Linkpath | 6.3 | |
| Medium | CVE-2024-28863 | Isaacs Node-tar: Allocation of Resources Without Limits or Throttling | 6.5 | |
| High | CVE-2026-23745 | Isaacs Node-tar: Path Traversal | 6.1 | |
| High | CVE-2026-23950 | node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS | 8.8 | |
| High | CVE-2026-31802 | node-tar Symlink Path Traversal via Drive-Relative Linkpath | 5.5 | |
| High | CVE-2026-26960 | Isaacs Node-tar: Path Traversal | 7.1 | |
| Medium | CVE-2026-53655 | Isaacs Node-tar: Interpretation Conflict | 5.5 | |
| Medium | CVE-2026-59875 | node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records | 5.3 | |
| Medium | CVE-2025-64118 | node-tar vulnerable to race condition leading to uninitialized memory exposure | — |