tar
7.5.22 · 24 Jul 2026BlueOak-1.0.0117.9M / weekRepositoryHomepagenpmAtom feed
Your version
6.1.2
26 Jul 20216.2.1 is the newest release of 6.x.
npm marks 6.1.2 as deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
Security
Fixes 1 advisory that affected 6.1.1
- HighArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoningGHSA-r628-mhmh-qjhw · 3 Aug 2021Fixed in 6.1.2
16 advisories affect 6.1.2; 7.5.21 fixes them
- Criticalnode-tar: Decompression/parse DoS via unlimited inputGHSA-23hp-3jrh-7fpw · 20 Jul 2026Fixed in 7.5.19
- Highnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionGHSA-r292-9mhp-454m · 24 Jul 2026Fixed in 7.5.21
- Highnode-tar: Negative tar entry size causes infinite loop in archive replaceGHSA-8x88-c5mf-7j5w · 20 Jul 2026Fixed in 7.5.18
- Highnode-tar Symlink Path Traversal via Drive-Relative LinkpathGHSA-9ppj-qmqm-q256 · 10 Mar 2026Fixed in 7.5.11
- Hightar has Hardlink Path Traversal via Drive-Relative LinkpathGHSA-qffp-2rhf-9h96 · 5 Mar 2026Fixed in 7.5.10
11 more
- HighArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar ExtractionGHSA-83g3-92jg-28cx · 18 Feb 2026Fixed in 7.5.8
- Highnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalGHSA-34x7-hfp2-rc4v · 28 Jan 2026Fixed in 7.5.7
- HighRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSGHSA-r6q2-hw4h-h46w · 21 Jan 2026Fixed in 7.5.4
- Highnode-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationGHSA-8qq5-rm4j-mr97 · 16 Jan 2026Fixed in 7.5.3
- HighArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksGHSA-9r2w-394v-53qc · 31 Aug 2021Fixed in 6.1.7
- HighArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksGHSA-qq89-hq3f-393p · 31 Aug 2021Fixed in 6.1.9
- HighArbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationGHSA-5955-9wpr-37jh · 31 Aug 2021Fixed in 6.1.9
- Moderatenode-tar: Process crash via PAX numeric path type confusionGHSA-w8wr-v893-vjvp · 20 Jul 2026Fixed in 7.5.18
- Moderatenode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsGHSA-gvwx-54wh-qm9j · 20 Jul 2026Fixed in 7.5.17
- Moderatenode-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)GHSA-vmf3-w455-68vh · 15 Jun 2026Fixed in 7.5.16
- ModerateDenial of service while parsing a tar file due to lack of folders count validationGHSA-f5x3-32g6-xq36 · 22 Mar 2024Fixed in 6.2.1
Release note
No note was found for 6.1.2 on GitHub or in the repository's changelog.