Every CVE Search/ Get API key

CVE-2021-37701

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

8.2 HighFix available

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

3.29%Up 2.2 points since Sep 1, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.2

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Record
CVE-2021-37701
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
EUVDEUVD-2021-1668 8.2

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Record
EUVD-2021-1668
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-9r2w-394v-53qc 8.2

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems.

By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created.

These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7.

The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available below.

Patches

4.4.16 || 5.0.8 || 6.1.7

Workarounds

Users may work around this vulnerability without upgrading by creating a custom filter method which prevents the extraction of symbolic links.

const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})

Users are encouraged to upgrade to the latest patched versions, rather than attempt to sanitize tar input themselves.

Fix

The problem is addressed in the following ways:

  1. All paths are normalized to use / as a path separator, replacing \ with / on Windows systems, and leaving \ intact in the path on posix systems. This is performed in depth, at every level of the program where paths are consumed.
  2. Directory cache pruning is performed case-insensitively. This may result in undue cache misses on case-sensitive file systems, but the performance impact is negligible.

Caveat

Note that this means that the entry objects exposed in various parts of tar's API will now always use / as a path separator, even on Windows systems. This is not expected to cause problems, as / is a valid path separator on Windows systems, but may result in issues if entry.path is compared against a path string coming from some other API such as fs.realpath() or path.resolve().

Users are encouraged to always normalize paths using a well-tested method such as path.resolve() before comparing paths to one another.

Record
GHSA-9r2w-394v-53qc
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
NVD 8.2

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Record
CVE-2021-37701
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSVALPINE-CVE-2021-37701 8.6

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Record
ALPINE-CVE-2021-37701
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-37701 8.6

CVE-2021-37701 does not affect BellSoft software

Record
BELL-CVE-2021-37701
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 29 moreShow less
OSV 8.6

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Record
CVE-2021-37701
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-37701 8.6

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Record
DEBIAN-CVE-2021-37701
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-9r2w-394v-53qc 8.2

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems.

By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created.

These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7.

The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available below.

Patches

4.4.16 || 5.0.8 || 6.1.7

Workarounds

Users may work around this vulnerability without upgrading by creating a custom filter method which prevents the extraction of symbolic links.

const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})

Users are encouraged to upgrade to the latest patched versions, rather than attempt to sanitize tar input themselves.

Fix

The problem is addressed in the following ways:

  1. All paths are normalized to use / as a path separator, replacing \ with / on Windows systems, and leaving \ intact in the path on posix systems. This is performed in depth, at every level of the program where paths are consumed.
  2. Directory cache pruning is performed case-insensitively. This may result in undue cache misses on case-sensitive file systems, but the performance impact is negligible.

Caveat

Note that this means that the entry objects exposed in various parts of tar's API will now always use / as a path separator, even on Windows systems. This is not expected to cause problems, as / is a valid path separator on Windows systems, but may result in issues if entry.path is compared against a path string coming from some other API such as fs.realpath() or path.resolve().

Users are encouraged to always normalize paths using a well-tested method such as path.resolve() before comparing paths to one another.

Record
GHSA-9r2w-394v-53qc
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSVRHEA-2022:4925 9.8

Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update

Record
RHEA-2022:4925
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHEA-2022:5139 9.8

Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update

Record
RHEA-2022:5139
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHEA-2022:5221 9.8

Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update

Record
RHEA-2022:5221
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHEA-2022:5615 9.8

Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update

Record
RHEA-2022:5615
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0041 9.8

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record
RHSA-2022:0041
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0246 9.8

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2022:0246
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0350 9.8

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2022:0350
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:4914 9.8

Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update

Record
RHSA-2022:4914
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:0350 9.8

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0350
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-37701 8.2

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Record
UBUNTU-CVE-2021-37701
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:0350 No score

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:0350
Updated
2026-11-02
OSVCLSA-2026-1775176111 No score

TuxCare security update for tar (2 CVEs)

TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.0.2-tuxcare.4.

Record
CLSA-2026-1775176111
Updated
2026-11-02
OSVCLSA-2026-1792164662 No score

TuxCare security update for tar (8 CVEs)

TuxCare rebuilt tar to address 8 CVEs. Fixed in 6.1.6-tuxcare.1.

Record
CLSA-2026-1792164662
Updated
2026-11-02
OSVCLSA-2026-1792369404 No score

TuxCare security update for tar (9 CVEs)

TuxCare rebuilt tar to address 9 CVEs. Fixed in 6.1.0-tuxcare.2.

Record
CLSA-2026-1792369404
Updated
2026-11-02
OSVMGASA-2021-0463 No score

Updated nodejs packages fix security vulnerability

Multiple security fixes for nodejs. See references for details

Record
MGASA-2021-0463
Updated
2026-11-02
OSVMGASA-2022-0103 No score

Updated nodejs-tar packages fix security vulnerability

Untrusted tar file to symlink into an arbitrary location allowing file overwrites. (CVE-2021-37712)

Arbitrary file creation/overwrite and arbitrary code execution. (CVE-2021-37701)

Arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. (CVE-2021-32803)

Arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization (CVE-2021-32804)

Record
MGASA-2022-0103
Updated
2026-11-02
OSVopenSUSE-SU-2021:1552-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

nodejs14 was updated to 14.18.1:

  • deps: update llhttp to 2.1.4

    • HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959)
    • HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960)

Changes in 14.18.0:

  • buffer:

    • introduce Blob
    • add base64url encoding option

  • child_process:

    • allow options.cwd receive a URL
    • add timeout to spawn and fork
    • allow promisified exec to be cancel
    • add 'overlapped' stdio flag

  • dns: add 'tries' option to Resolve options

  • fs:

    • allow empty string for temp directory prefix
    • allow no-params fsPromises fileHandle read
    • add support for async iterators to fsPromises.writeFile

  • http2: add support for sensitive headers

  • process: add 'worker' event

  • tls: allow reading data into a static buffer

  • worker: add setEnvironmentData/getEnvironmentData

Changes in 14.17.6

  • deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1552-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1574-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601).
  • CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602).
  • CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057).
  • CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056).
  • CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055).
  • CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054).
  • CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1574-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3940-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601).
  • CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602).
  • CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057).
  • CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056).
  • CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055).
  • CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054).
  • CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053).
Record
openSUSE-SU-2021:3940-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3964-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

nodejs14 was updated to 14.18.1:

  • deps: update llhttp to 2.1.4

    • HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959)
    • HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960)

Changes in 14.18.0:

  • buffer:

    • introduce Blob
    • add base64url encoding option

  • child_process:

    • allow options.cwd receive a URL
    • add timeout to spawn and fork
    • allow promisified exec to be cancel
    • add 'overlapped' stdio flag

  • dns: add 'tries' option to Resolve options

  • fs:

    • allow empty string for temp directory prefix
    • allow no-params fsPromises fileHandle read
    • add support for async iterators to fsPromises.writeFile

  • http2: add support for sensitive headers

  • process: add 'worker' event

  • tls: allow reading data into a static buffer

  • worker: add setEnvironmentData/getEnvironmentData

Changes in 14.17.6

  • deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135)
Record
openSUSE-SU-2021:3964-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11616-1 No score

nodejs14-14.18.1-1.1 on GA media

These are all security issues fixed in the nodejs14-14.18.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11616-1
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2021-37701 No score

CVE-2021-37701 in tar - Patched by Root

Root has patched CVE-2021-37701 in the tar package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2021-37701
Updated
2026-11-02
OSVSUSE-SU-2021:3886-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

nodejs14 was updated to 14.18.1:

  • deps: update llhttp to 2.1.4

Security fixes:

  • HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959)
  • HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960)

Changes in 14.18.0:

  • buffer:

    • introduce Blob
    • add base64url encoding option

  • child_process:

    • allow options.cwd receive a URL
    • add timeout to spawn and fork
    • allow promisified exec to be cancel
    • add 'overlapped' stdio flag

  • dns: add 'tries' option to Resolve options

  • fs:

    • allow empty string for temp directory prefix
    • allow no-params fsPromises fileHandle read
    • add support for async iterators to fsPromises.writeFile

  • http2: add support for sensitive headers

  • process: add 'worker' event

  • tls: allow reading data into a static buffer

  • worker: add setEnvironmentData/getEnvironmentData

Changes in 14.17.6:

  • deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135)
Record
SUSE-SU-2021:3886-1
Updated
2026-11-02
OSVSUSE-SU-2021:3940-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601).
  • CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602).
  • CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057).
  • CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056).
  • CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055).
  • CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054).
  • CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053).
Record
SUSE-SU-2021:3940-1
Updated
2026-11-02
OSVSUSE-SU-2021:3964-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

nodejs14 was updated to 14.18.1:

  • deps: update llhttp to 2.1.4

    • HTTP Request Smuggling due to spaced in headers (bsc#1191601, CVE-2021-22959)
    • HTTP Request Smuggling when parsing the body (bsc#1191602, CVE-2021-22960)

Changes in 14.18.0:

  • buffer:

    • introduce Blob
    • add base64url encoding option

  • child_process:

    • allow options.cwd receive a URL
    • add timeout to spawn and fork
    • allow promisified exec to be cancel
    • add 'overlapped' stdio flag

  • dns: add 'tries' option to Resolve options

  • fs:

    • allow empty string for temp directory prefix
    • allow no-params fsPromises fileHandle read
    • add support for async iterators to fsPromises.writeFile

  • http2: add support for sensitive headers

  • process: add 'worker' event

  • tls: allow reading data into a static buffer

  • worker: add setEnvironmentData/getEnvironmentData

Changes in 14.17.6

  • deps: upgrade npm to 6.14.15 which fixes a number of security issues (bsc#1190057, CVE-2021-37701, bsc#1190056, CVE-2021-37712, bsc#1190055, CVE-2021-37713, bsc#1190054, CVE-2021-39134, bsc#1190053, CVE-2021-39135)
Record
SUSE-SU-2021:3964-1
Updated
2026-11-02
OSVSUSE-SU-2022:0101-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names (bsc#1194511).
  • CVE-2021-44532: Fixed certificate Verification Bypass via String Injection (bsc#1194512).
  • CVE-2021-44533: Fixed incorrect handling of certificate subject and issuer fields (bsc#1194513).
  • CVE-2022-21824: Fixed prototype pollution via console.table properties (bsc#1194514).
  • CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers(bsc#1191601).
  • CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602).
  • CVE-2021-37701: Fixed arbitrary file creation and overwrite vulnerability in nodejs-tar (bsc#1190057).
  • CVE-2021-37712: Fixed arbitrary file creation and overwrite vulnerability in nodejs-tar (bsc#1190056).
  • CVE-2021-37713: Fixed arbitrary file creation/overwrite and arbitrary code execution vulnerability in nodejs-tar (bsc#1190055).
  • CVE-2021-39134: Fixed symlink following vulnerability in nodejs-arborist (bsc#1190054).
  • CVE-2021-39135: Fixed symlink following vulnerability in nodejs-arborist (bsc#1190053).
Record
SUSE-SU-2022:0101-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tar
npm
 5.0.0 up to 5.0.8
5.0.8
tar
npm
 6.0.0 up to 6.1.7
6.1.7
tar
npm
 3.0.0 up to 4.4.16
4.4.16
nodejs
Alpine:v3.11
 before 12.22.6-r0
12.22.6-r0
nodejs
Alpine:v3.12
 before 12.22.6-r0
12.22.6-r0
nodejs
Alpine:v3.13
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.14
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.15
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.16
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.17
 before 14.17.6-r0
14.17.6-r0
Show 119 moreShow less
Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.18
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.19
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.20
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.21
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.22
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.23
 before 14.17.6-r0
14.17.6-r0
nodejs
Alpine:v3.24
 before 14.17.6-r0
14.17.6-r0
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.0.15-1.module_el8.6.0+2904+f21ad6f4
2.0.15-1.module_el8.6.0+2904+f21ad6f4
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.0.15-1.module_el8.5.0+2605+45d748af
2.0.15-1.module_el8.5.0+2605+45d748af
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.0.15-1.module_el8.5.0+2618+8d46dafd
2.0.15-1.module_el8.5.0+2618+8d46dafd
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 23-3.module_el8.5.0+2618+8d46dafd
23-3.module_el8.5.0+2618+8d46dafd
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 23-3.module_el8.4.0+2522+3bd42762
23-3.module_el8.4.0+2522+3bd42762
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
tar
TuxCare:npm
From an advisory covering 2 CVEs
 6.0.2-tuxcare.0 up to 6.0.2-tuxcare.4, plus listed versions
6.0.26.0.2-tuxcare.16.0.2-tuxcare.26.0.2-tuxcare.3
6.0.2-tuxcare.4
tar
TuxCare:npm
From an advisory covering 8 CVEs
 6.1.6-tuxcare.0 up to 6.1.6-tuxcare.1, plus listed versions
6.1.6
6.1.6-tuxcare.1
tar
TuxCare:npm
From an advisory covering 9 CVEs
 6.1.0-tuxcare.0 up to 6.1.0-tuxcare.2, plus listed versions
6.1.06.1.0-tuxcare.1
6.1.0-tuxcare.2
node-tar
Debian:12
 before 6.1.7+~cs11.3.10-1
6.1.7+~cs11.3.10-1
node-tar
Debian:13
 before 6.1.7+~cs11.3.10-1
6.1.7+~cs11.3.10-1
node-tar
Debian:14
 before 6.1.7+~cs11.3.10-1
6.1.7+~cs11.3.10-1
node-tar
Debian:10
From an advisory covering 2 CVEs
 before 4.4.6+ds1-3+deb10u2, plus listed versions
4.4.6+ds1-34.4.6+ds1-3+deb10u1
4.4.6+ds1-3+deb10u2
node-tar
Debian:11
From an advisory covering 2 CVEs
 before 6.0.5+ds1+~cs11.3.9-1+deb11u2, plus listed versions
6.0.5+ds1+~cs11.3.9-16.0.5+ds1+~cs11.3.9-1+deb11u1
6.0.5+ds1+~cs11.3.9-1+deb11u2
nodejs
Mageia:8
From an advisory covering 9 CVEs
 before 14.17.6-1.mga8
14.17.6-1.mga8
nodejs-tar
Mageia:8
From an advisory covering 4 CVEs
 before 6.0.5-1.1.mga8
6.0.5-1.1.mga8
nodejs
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
nodejs-debuginfo
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
nodejs-debugsource
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
nodejs-devel
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
nodejs-docs
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
nodejs-full-i18n
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
1:12.22.12-1.module+el8.1.0+15296+87b2f6ad
nodejs-nodemon
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 9 CVEs
 before 1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad
1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2.0.3-1.module+el8.4.0+11732+c668cc9f
0:2.0.3-1.module+el8.4.0+11732+c668cc9f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d
1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d
nodejs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
nodejs-debuginfo
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
nodejs-debugsource
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
nodejs-devel
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
nodejs-docs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
nodejs-full-i18n
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
1:12.22.12-1.module+el8.2.0+15322+a70ca0ab
nodejs-nodemon
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 9 CVEs
 before 1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab
1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab
nodejs
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.4.0+15323+4d1cc445
1:12.22.12-1.module+el8.4.0+15323+4d1cc445
nodejs-debuginfo
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.4.0+15323+4d1cc445
1:12.22.12-1.module+el8.4.0+15323+4d1cc445
nodejs-debugsource
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.4.0+15323+4d1cc445
1:12.22.12-1.module+el8.4.0+15323+4d1cc445
nodejs-devel
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.4.0+15323+4d1cc445
1:12.22.12-1.module+el8.4.0+15323+4d1cc445
nodejs-docs
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.4.0+15323+4d1cc445
1:12.22.12-1.module+el8.4.0+15323+4d1cc445
nodejs-full-i18n
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:12.22.12-1.module+el8.4.0+15323+4d1cc445
1:12.22.12-1.module+el8.4.0+15323+4d1cc445
nodejs-nodemon
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:2.0.3-1.module+el8.4.0+11732+c668cc9f
0:2.0.3-1.module+el8.4.0+11732+c668cc9f
nodejs-packaging
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445
1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445
rh-nodejs14-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:14.18.2-1.el7
0:14.18.2-1.el7
rh-nodejs14-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:14.18.2-1.el7
0:14.18.2-1.el7
rh-nodejs14-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:14.18.2-1.el7
0:14.18.2-1.el7
rh-nodejs14-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:14.18.2-1.el7
0:14.18.2-1.el7
rh-nodejs14-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:2.0.3-6.el7
0:2.0.3-6.el7
rh-nodejs14-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:6.14.15-14.18.2.1.el7
0:6.14.15-14.18.2.1.el7
nodejs
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-debuginfo
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-debugsource
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-devel
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-docs
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-full-i18n
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-nodemon
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:2.0.15-1.module+el8.4.0+13503+fc29810b
0:2.0.15-1.module+el8.4.0+13503+fc29810b
nodejs-packaging
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22
1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2.0.15-1.module+el8.5.0+13504+a2e74d91
0:2.0.15-1.module+el8.5.0+13504+a2e74d91
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.12-2.el7
0:12.22.12-2.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.12-2.el7
0:12.22.12-2.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.12-2.el7
0:12.22.12-2.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.12-2.el7
0:12.22.12-2.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:6.14.16-12.22.12.2.el7
0:6.14.16-12.22.12.2.el7
nodejs
Rocky Linux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+733+de4fee6c
1:14.18.2-2.module+el8.5.0+733+de4fee6c
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:2.0.15-1.module+el8.5.0+721+4c107270
0:2.0.15-1.module+el8.5.0+721+4c107270
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.7.0+1071+4bdda2a8
0:23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.3.0+100+234774f7
0:23-3.module+el8.3.0+100+234774f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.5.0+733+de4fee6c
0:23-3.module+el8.5.0+733+de4fee6c
tar
Root:npm
 before 4.4.13-aikido.1
4.4.13-aikido.1
@rootio/tar
Root:npm
 before 4.4.13-root.io.1
4.4.13-root.io.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 7 CVEs
 before 14.18.1-6.18.2
14.18.1-6.18.2
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 7 CVEs
 before 12.22.7-4.22.1
12.22.7-4.22.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 7 CVEs
 before 12.22.7-4.22.1
12.22.7-4.22.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 7 CVEs
 before 14.18.1-15.21.2
14.18.1-15.21.2
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 7 CVEs
 before 14.18.1-15.21.2
14.18.1-15.21.2
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 11 CVEs
 before 12.22.9-1.38.1
12.22.9-1.38.1
node-tar
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.1.18-10.1.18-1ubuntu0.1~esm1
 None known
node-tar
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.3-21.0.3-2ubuntu0.1~esm1
 None known
node-tar
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.2.1-1
 None known
node-tar
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.4.10+ds1-24.4.10+ds1-2ubuntu14.4.10+ds1-2ubuntu1+esm1
 None known
nodejs14
openSUSE:Leap 15.2
From an advisory covering 7 CVEs
 before 14.18.1-lp152.17.1
14.18.1-lp152.17.1
nodejs12
openSUSE:Leap 15.2
From an advisory covering 7 CVEs
 before 12.22.7-lp152.3.21.1
12.22.7-lp152.3.21.1
nodejs12
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 12.22.7-4.22.1
12.22.7-4.22.1
nodejs14
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 14.18.1-15.21.2
14.18.1-15.21.2
nodejs14
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 14.18.1-1.1
14.18.1-1.1

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-37701 is a high vulnerability (CVSS 8.2) in Isaacs Node-tar, published August 31, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.29%, the 88th percentile. Fixed in tar 5.0.8.

References

Show 142 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open