CVE-2025-64118
node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
- Affected products
- Node-Tar
- Fix
- Available
- CVSS 4.0
- 6.1 MEDIUM
- EPSS
- 0.1% (3th percentile)
- Weakness
- CWE-362, CWE-367
- NVD status
- Deferred
- Published
- 2025-10-30
CVE-2025-64118 at NVD
No indexed exploits for CVE-2025-64118 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-64118 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.