15 matches found
node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
GHSA-8X88-C5MF-7J5W node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
Infinite loop
Overview org.webjars.npm:tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Infinite loop via the replace method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size...
CVE-2026-59874
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
DEBIAN-CVE-2026-59874
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
CVE-2026-59874
node-tar is a Node.js tar archive library. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to loop on the same header and make no progress; this is fixed in version 7.5.18. Upgrade to 7.5.18 to remediate. Th...
CVE-2026-59874
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
PT-2026-56494
Name of the Vulnerable Software and Affected Versions node-tar versions prior to 7.5.18 Description The tar.replace function accepts a checksum-valid tar header containing a negative base-256 encoded entry size. This causes the archive scanner to enter a loop where it repeatedly parses the same...
CLSA-2023-1677791921 tar: Fix of CVE-2022-48303
CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...
tar: Fix of CVE-2022-48303
CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...
CLSA-2023-1677784249 Fix CVE(s): CVE-2022-48303, CVE-2021-20193
SECURITY UPDATE: memory leak in readheader - debian/patches/CVE-2021-20193.patch: Don't return directly from the loop. Instead set the status and break. Return the status. - CVE-2021-20193.patch SECURITY UPDATE: a heap buffer overflow - debian/patches/CVE-2022-48303.patch: Check for the end of...
CLSA-2023-1677783967 tar: Fix of CVE-2022-48303
CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...