Every CVE Search/ Get API key

CVE-2021-32804

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

8.2 HighPublic exploitFix available

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

15.1%Up 14.0 points since Aug 4, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.2

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Record
CVE-2021-32804
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2021-1548 8.2

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Record
EUVD-2021-1548
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-3jfq-g458-7qm9 8.2

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc.

This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite.

Patches

3.2.2 || 4.4.14 || 5.0.6 || 6.1.1

NOTE: an adjacent issue CVE-2021-32803 affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your node-tar use case.

Workarounds

Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths.

const path = require('path')
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  // either add this function...
  onentry: (entry) => {
    if (path.isAbsolute(entry.path)) {
      entry.path = sanitizeAbsolutePathSomehow(entry.path)
      entry.absolute = path.resolve(entry.path)
    }
  },

  // or this one
  filter: (file, entry) => {
    if (path.isAbsolute(entry.path)) {
      return false
    } else {
      return true
    }
  }
})

Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.

Record
GHSA-3jfq-g458-7qm9
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 8.2

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Record
CVE-2021-32804
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2021-32804 8.1

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Record
ALPINE-CVE-2021-32804
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-32804 8.1

CVE-2021-32804 does not affect BellSoft software

Record
BELL-CVE-2021-32804
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
Show 33 moreShow less
OSV 8.1

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Record
CVE-2021-32804
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-32804 8.1

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Record
DEBIAN-CVE-2021-32804
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVGHSA-3jfq-g458-7qm9 8.2

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc.

This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite.

Patches

3.2.2 || 4.4.14 || 5.0.6 || 6.1.1

NOTE: an adjacent issue CVE-2021-32803 affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your node-tar use case.

Workarounds

Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths.

const path = require('path')
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  // either add this function...
  onentry: (entry) => {
    if (path.isAbsolute(entry.path)) {
      entry.path = sanitizeAbsolutePathSomehow(entry.path)
      entry.absolute = path.resolve(entry.path)
    }
  },

  // or this one
  filter: (file, entry) => {
    if (path.isAbsolute(entry.path)) {
      return false
    } else {
      return true
    }
  }
})

Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.

Record
GHSA-3jfq-g458-7qm9
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2021:3280 9.8

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record
RHSA-2021:3280
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3281 9.8

Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update

Record
RHSA-2021:3281
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3623 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3623
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3638 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3639 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3639
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3666 9.8

Red Hat Security Advisory: nodejs:14 security and bug fix update

Record
RHSA-2021:3666
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:3623 9.8

Important: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)
Record
RLSA-2021:3623
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:3666 9.8

Important: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)
Record
RLSA-2021:3666
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-32804 8.2

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Record
UBUNTU-CVE-2021-32804
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVALSA-2021:3623 No score

Important: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)
Record
ALSA-2021:3623
Updated
2026-11-02
OSVALSA-2021:3666 No score

Important: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)
Record
ALSA-2021:3666
Updated
2026-11-02
OSVCLSA-2026-1773188129 No score

TuxCare security update for tar (7 CVEs)

TuxCare rebuilt tar to address 7 CVEs. Fixed in 2.2.2-tuxcare.1.

Record
CLSA-2026-1773188129
Updated
2026-11-02
OSVCLSA-2026-1773620217 No score

TuxCare security update for tar (4 CVEs)

TuxCare rebuilt tar to address 4 CVEs. Fixed in 1.0.3-tuxcare.1.

Record
CLSA-2026-1773620217
Updated
2026-11-02
OSVCLSA-2026-1774484514 No score

TuxCare security update for tar (5 CVEs)

TuxCare rebuilt tar to address 5 CVEs. Fixed in 2.1.1-tuxcare.1.

Record
CLSA-2026-1774484514
Updated
2026-11-02
OSVCLSA-2026-1775176096 No score

TuxCare security update for tar (1 CVE)

TuxCare rebuilt tar to address 1 CVE. Fixed in 6.0.2-tuxcare.2.

Record
CLSA-2026-1775176096
Updated
2026-11-02
OSVCLSA-2026-1777941831 No score

TuxCare security update for tar (1 CVE)

TuxCare rebuilt tar to address 1 CVE. Fixed in 2.2.1-tuxcare.1.

Record
CLSA-2026-1777941831
Updated
2026-11-02
OSVCLSA-2026-1793364175 No score

TuxCare security update for tar (2 CVEs)

TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.1.0-tuxcare.4.

Record
CLSA-2026-1793364175
Updated
2026-11-02
OSVMGASA-2022-0103 No score

Updated nodejs-tar packages fix security vulnerability

Untrusted tar file to symlink into an arbitrary location allowing file overwrites. (CVE-2021-37712)

Arbitrary file creation/overwrite and arbitrary code execution. (CVE-2021-37701)

Arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. (CVE-2021-32803)

Arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization (CVE-2021-32804)

Record
MGASA-2022-0103
Updated
2026-11-02
OSVopenSUSE-SU-2022:0657-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
openSUSE-SU-2022:0657-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0704-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
openSUSE-SU-2022:0704-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0715-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
openSUSE-SU-2022:0715-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2021-32804 No score

CVE-2021-32804 in tar - Patched by Root

Root has patched CVE-2021-32804 in the tar package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2021-32804
Updated
2026-11-02
OSVSUSE-SU-2022:0531-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
SUSE-SU-2022:0531-1
Updated
2026-11-02
OSVSUSE-SU-2022:0563-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
SUSE-SU-2022:0563-1
Updated
2026-11-02
OSVSUSE-SU-2022:0569-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
SUSE-SU-2022:0569-1
Updated
2026-11-02
OSVSUSE-SU-2022:0570-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
  • CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).
Record
SUSE-SU-2022:0570-1
Updated
2026-11-02
OSVSUSE-SU-2022:0657-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
SUSE-SU-2022:0657-1
Updated
2026-11-02
OSVSUSE-SU-2022:0704-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
SUSE-SU-2022:0704-1
Updated
2026-11-02
OSVSUSE-SU-2022:0715-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
Record
SUSE-SU-2022:0715-1
Updated
2026-11-02
OSVSUSE-SU-2022:1717-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
  • CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).
  • CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).
  • CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).
  • CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).
Record
SUSE-SU-2022:1717-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tar
npm
 before 3.2.2
3.2.2
tar
npm
 4.0.0 up to 4.4.14
4.4.14
tar
npm
 5.0.0 up to 5.0.6
5.0.6
tar
npm
 6.0.0 up to 6.1.1
6.1.1
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.5.0+85+79a7b441
1:12.22.5-1.module_el8.5.0+85+79a7b441
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.5.0+85+79a7b441
1:12.22.5-1.module_el8.5.0+85+79a7b441
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs-docs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.5.0+85+79a7b441
1:12.22.5-1.module_el8.5.0+85+79a7b441
Show 172 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs-nodemon
AlmaLinux:8
From an advisory covering 8 CVEs
 before 2.0.3-1.module_el8.4.0+2521+c668cc9f
2.0.3-1.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
npm
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
npm
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 23-3.module_el8.5.0+254+b4526b16
23-3.module_el8.5.0+254+b4526b16
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 23-3.module_el8.4.0+2522+3bd42762
23-3.module_el8.4.0+2522+3bd42762
tar
TuxCare:npm
From an advisory covering 7 CVEs
 2.2.2-tuxcare.0 up to 2.2.2-tuxcare.1, plus listed versions
2.2.2
2.2.2-tuxcare.1
tar
TuxCare:npm
From an advisory covering 4 CVEs
 1.0.3-tuxcare.0 up to 1.0.3-tuxcare.1, plus listed versions
1.0.3
1.0.3-tuxcare.1
tar
TuxCare:npm
From an advisory covering 5 CVEs
 2.1.1-tuxcare.0 up to 2.1.1-tuxcare.1, plus listed versions
2.1.1
2.1.1-tuxcare.1
tar
TuxCare:npm
 6.0.2-tuxcare.0 up to 6.0.2-tuxcare.2, plus listed versions
6.0.26.0.2-tuxcare.1
6.0.2-tuxcare.2
tar
TuxCare:npm
 2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions
2.2.1
2.2.1-tuxcare.1
tar
TuxCare:npm
From an advisory covering 2 CVEs
 6.1.0-tuxcare.0 up to 6.1.0-tuxcare.4, plus listed versions
6.1.06.1.0-tuxcare.16.1.0-tuxcare.26.1.0-tuxcare.3
6.1.0-tuxcare.4
node-tar
Debian:12
 before 6.1.7+~cs11.3.10-1
6.1.7+~cs11.3.10-1
node-tar
Debian:13
 before 6.1.7+~cs11.3.10-1
6.1.7+~cs11.3.10-1
node-tar
Debian:14
 before 6.1.7+~cs11.3.10-1
6.1.7+~cs11.3.10-1
nodejs-tar
Mageia:8
From an advisory covering 4 CVEs
 before 6.0.5-1.1.mga8
6.0.5-1.1.mga8
rh-nodejs14-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:2.0.3-5.el7
0:2.0.3-5.el7
rh-nodejs14-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:6.14.14-14.17.5.1.el7
0:6.14.14-14.17.5.1.el7
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:2.0.3-5.el7
0:2.0.3-5.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:6.14.14-12.22.5.1.el7
0:6.14.14-12.22.5.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.4.0+11732+c668cc9f
0:2.0.3-1.module+el8.4.0+11732+c668cc9f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
nodejs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debuginfo
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debugsource
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-devel
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-docs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-full-i18n
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-nodemon
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
nodejs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debuginfo
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debugsource
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-devel
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-docs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-full-i18n
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-nodemon
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.3.0+6519+9f98ed83
0:2.0.3-1.module+el8.3.0+6519+9f98ed83
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
nodejs
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+647+e905fa21
1:12.22.5-1.module+el8.4.0+647+e905fa21
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4
0:2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.3.0+100+234774f7
0:2.0.3-1.module+el8.3.0+100+234774f7
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.4.0+638+5344c6f7
0:2.0.3-1.module+el8.4.0+638+5344c6f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+654+17ff1d38
1:14.17.5-1.module+el8.4.0+654+17ff1d38
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.7.0+1071+4bdda2a8
0:23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.3.0+100+234774f7
0:23-3.module+el8.3.0+100+234774f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.5.0+733+de4fee6c
0:23-3.module+el8.5.0+733+de4fee6c
tar
Root:npm
 before 4.4.13-aikido.1
4.4.13-aikido.1
@rootio/tar
Root:npm
 before 4.4.13-root.io.1
4.4.13-root.io.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 12.22.10-1.42.2
12.22.10-1.42.2
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs8
SUSE:Enterprise Storage 6
From an advisory covering 5 CVEs
 before 8.17.0-3.54.2
8.17.0-3.54.2
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 14.19.0-6.24.1
14.19.0-6.24.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 6 CVEs
 before 10.24.1-1.46.1
10.24.1-1.46.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Manager Proxy 4.1
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Manager Server 4.1
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs12
SUSE:Enterprise Storage 7
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Manager Proxy 4.1
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Manager Proxy 4.1
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Manager Server 4.1
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Manager Server 4.1
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs-common
SUSE:Enterprise Storage 6
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs-common
SUSE:Enterprise Storage 7
From an advisory covering 5 CVEs
 before 2.0-3.4.1
2.0-3.4.1
nodejs8
SUSE:Enterprise Storage 7
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Manager Proxy 4.1
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Manager Server 4.1
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs14
SUSE:Enterprise Storage 7
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Manager Proxy 4.1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Manager Server 4.1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Enterprise Storage 6
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Enterprise Storage 7
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
openSUSE:Leap 15.3
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
openSUSE:Leap 15.4
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
node-tar
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.1.18-10.1.18-1ubuntu0.1~esm1
 None known
node-tar
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.3-21.0.3-2ubuntu0.1~esm1
 None known
node-tar
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.2.1-1
 None known
node-tar
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.4.10+ds1-24.4.10+ds1-2ubuntu14.4.10+ds1-2ubuntu1+esm1
 None known
node-tar
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.1.7+~cs11.3.10-16.1.11+~cs11.3.10-16.1.11+ds1+~cs6.0.6-1
 None known
node-tar
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.1.13+~cs7.0.5-16.1.13+~cs7.0.5-3
 None known
node-tar
Ubuntu:25.10
 All versions, plus listed versions
6.2.1+~cs7.0.8-1
 None known
node-tar
Ubuntu:26.10
 All versions, plus listed versions
6.2.1+ds1+~cs6.1.13-107.5.22+~4.0.1-1
 None known
node-tar
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.2.1+~cs7.0.8-16.2.1+ds1+~cs6.1.13-66.2.1+ds1+~cs6.1.13-76.2.1+ds1+~cs6.1.13-10
 None known
nodejs12
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 12.22.10-4.29.3
12.22.10-4.29.3
nodejs8
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 8.17.0-10.19.2
8.17.0-10.19.2
nodejs14
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 14.19.0-15.27.1
14.19.0-15.27.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubyamory/CVE-2021-328042021-08-31
PoC in GitHubfedericonbaez/cortex9-node-tar-path-sanitization-model2026-11-06

History

History
RecordedChangedSources
exploitsPoC in GitHub
affected, facts
affected
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32804 is a high vulnerability (CVSS 8.2) in Isaacs Node-tar, published August 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 15.1%, the 96th percentile. Fixed in tar 3.2.2.

References

Show 135 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open