An open index of dependabot pull requests across open source projects.

tar

Ecosystem:
npm
Package URL:
pkg:npm/tar
Total PRs:
16,012 Dependabot PRs
Latest PR:
about 16 hours ago
Unique Repositories:
11,574 repositories
Unique Repos (30 days):
60 repositories
Security Advisories
node-tar: Process crash via PAX numeric path type confusion
GHSA-w8wr-v893-vjvp CVE-2026-59871 MODERATE published 2 days ago • updated 2 days ago
### Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaS...
node-tar: Decompression/parse DoS via unlimited input
GHSA-23hp-3jrh-7fpw CVE-2026-59873 CRITICAL published 2 days ago • updated 2 days ago
### Summary A **Decompression/parse DoS via unlimited input** vulnerability in `node-tar` allows an attacker to exhaust server resources (disk spac...
node-tar: Negative tar entry size causes infinite loop in archive replace
GHSA-8x88-c5mf-7j5w CVE-2026-59874 HIGH published 2 days ago • updated 2 days ago
### Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the exis...
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
GHSA-gvwx-54wh-qm9j CVE-2026-59875 MODERATE published 2 days ago • updated 2 days ago
## Summary `node-tar` strips trailing `NUL` bytes from long-name (`L`) and long-linkpath (`K`) GNU extended headers but does **not** apply the sam...
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
GHSA-5955-9wpr-37jh CVE-2021-37713 HIGH published almost 5 years ago • updated about 3 hours ago
### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location wo...
Recent PRs (filtered by: Patch PRs )
Bump tar from 7.5.10 to 7.5.17

dauxio/daux.io #560

7.5.10 → 7.5.17 Patch PR
Open about 1 month ago 1 comment
dauxio
Bump tar from 7.5.13 to 7.5.16

DSpace/dspace-angular #5865

7.5.13 → 7.5.16 Patch PR
Closed about 1 month ago 1 comment
DSpace
Bump tar from 2.2.1 to 2.2.2

lisaross/react-loadable #3

2.2.1 → 2.2.2 Patch PR
Open about 1 month ago 1 comment
lisaross
Package Details
Name: tar
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/tar
JSON API: View JSON
Security Advisories

19

Active advisories
CRITICAL 1
HIGH 14
MODERATE 4
View All npm Advisories
Package Information
Description:

tar for node

Repository: https://github.com/isaacs/node-tar
Homepage: https://github.com/isaacs/node-tar#readme
Latest Release: 7.4.3
almost 2 years ago
Dependent Repos: 3,179,743
Dependent Packages: 5,040
Downloads: 170,210,137
Ranking: Top 0.0051% by dependent repos Top 0.0126% by downloads Top 0.0176% by dependent pkgs
PR Status
Open 6,287 (39.3%)
Merged 321 (2.0%)
Closed 9,244 (57.7%)
PR Types
Major 2,809 (17.5%)
Minor 4,792 (29.9%)
Patch 6,654 (41.6%)
Removal 1,354 (8.5%)