CVE-2025-64118: isaacs node-tar Race Condition
CVSS: 6.1v4.0MediumDeferred
AliasesUBUNTU-CVE-2025-64118CGA-2fxv-j2qr-qq94CGA-3qmr-xfp9-cfj6CGA-6qp8-pm3j-99hwCGA-9fhh-r399-rwrpCGA-fmhh-fr46-2rm9CGA-gjvc-5m82-f79pCGA-m7qp-j26m-px59CGA-r8pf-2vmm-9fmpGHSA-29xp-372q-xqphCGA-4h6f-xqww-8997CGA-pfqm-gw64-634jCGA-r5f6-x925-6vpvCGA-vx4c-682q-w5xv
Published 30-10-2025Last modified 30-10-2025
Vulnerability summary
CVE-2025-64118 is a medium (CVSS 6.1) Race Condition vulnerability in isaacs node-tar. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v4.0 (CVE.org)EPSS score
0.13%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 4Timeline
- 30-10-2025PublishedVulnerability first disclosed.
- 30-10-2025Last modifiedVulnerability information updated.
Description
node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
- NVDNIST6.1MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.01 pp
From 0.13% on 20-09-2026
20-09-202620-10-2026
EPSS score0.13%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Affected systems
Chainguard6 products
- actions-runnerAll versions (No fix recorded)
- actions-runner-compatAll versions (No fix recorded)
- node-gyp< 12.0.0-r0
- npmAll versions (No fix recorded)
- npm-docAll versions (No fix recorded)
Wolfi4 products
- node-gyp< 12.0.0-r0
- npmAll versions (No fix recorded)
- npm-docAll versions (No fix recorded)
- renovate< 41.169.3-r0
Isaacs1 product
- node-tar= 7.5.1
Npm1 product
- tar≥ 7.5.1, < 7.5.2
Ubuntu1 product
- node-tarAll versions (No fix recorded)
5 vendors · 13 products
References
10 links- github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqphX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224dX Refsource MISCREPORTFIXWEB
- github.com/isaacs/node-tarPACKAGE