PT-2025-44446

CVE-2025-64118

Published

2025-10-30

Updated

2026-10-07

Description by

CVSS 4.0

6.1

Medium

MetricsAV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.2

Description node-tar is a Tar for Node.js. When using the .t (also known as .list) function with the { sync: true } option to read tar entry contents, uninitialized memory contents may be returned if the tar file is modified on disk to a smaller size during the read operation.

Recommendations Update to version 7.5.2 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\'Race Condition\')

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Related identifiers

CVE-2025-64118