[SECURITY] [DLA 4552-1] node-tar security update

🗓️ 29 Apr 2026 03:09:01Reported by DebianType

Debian eleven security update for node-tar addressing multiple CVEs including path traversal and memory issues.

Reporter	Title	Published	Views	Family All 536
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	8 Jan 202518:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Denial of Service (DoS) due to tar	17 Dec 202510:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	21 Apr 202618:47	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	31 Mar 202613:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	4 Dec 202410:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	17 Mar 202603:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses node-tar which is vulnerable to CVE-2026-23745	20 Mar 202611:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in tar-6.2.0.tgz	7 Jul 202517:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-7.5.7.tgz	28 Apr 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	2 Feb 202614:19	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	node-tar	6.0.5+ds1+~cs11.3.9-1+deb11u3	node-tar_6.0.5+ds1+~cs11.3.9-1+deb11u3_any.deb

29 Apr 2026 03:09Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.1 - 8.6

CVSS 48.2

EPSS0.00929

SSVC