{"id":"CVE-2021-32803","aliases":["ALPINE-CVE-2021-32803","ALSA-2021:3623","ALSA-2021:3666","BELL-CVE-2021-32803","CLSA-2026-1775176089","CLSA-2026-1787823934","CLSA-2026-1792164455","DEBIAN-CVE-2021-32803","EUVD-2021-1856","GHSA-5c6j-r48x-rmvq","GHSA-r628-mhmh-qjhw","MGASA-2022-0103","RHSA-2021:3280","RHSA-2021:3281","RHSA-2021:3623","RHSA-2021:3638","RHSA-2021:3639","RHSA-2021:3666","RLSA-2021:3623","RLSA-2021:3666","ROOT-APP-NPM-CVE-2021-32803","SUSE-SU-2022:0531-1","SUSE-SU-2022:0563-1","SUSE-SU-2022:0569-1","SUSE-SU-2022:0570-1","SUSE-SU-2022:0657-1","SUSE-SU-2022:0704-1","SUSE-SU-2022:0715-1","SUSE-SU-2022:1717-1","UBUNTU-CVE-2021-32803","USN-5283-1","openSUSE-SU-2022:0657-1","openSUSE-SU-2022:0704-1","openSUSE-SU-2022:0715-1"],"status":"published","title":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.07795,"percentile":0.94734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-23","CWE-59"],"published":"2021-08-03T19:00:40Z","modified":"2026-10-29T11:00:46Z","fixes":[{"ecosystem":"npm","package":"tar","fixed_in":["4.4.15","5.0.7","6.1.2","3.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"tar","fixed_in":["6.0.2-tuxcare.1","6.1.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-tar","fixed_in":["6.1.7+~cs11.3.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-tar","fixed_in":["6.1.7+~cs11.3.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tar","fixed_in":["6.1.7+~cs11.3.10-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar","fixed_in":["4.4.13-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar","fixed_in":["4.4.13-root.io.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-tar","fixed_in":["4.4.10+ds1-2ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.15"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2-tuxcare.0"},{"fixed":"6.0.2-tuxcare.1"}]}],"versions":["6.0.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0-tuxcare.0"},{"fixed":"6.1.0-tuxcare.1"}]}],"versions":["6.1.0"]},{"source":"osv","ecosystem":"Debian:12","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.7+~cs11.3.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.7+~cs11.3.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.7+~cs11.3.10-1"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.4.15"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.7"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.1.2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1.1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-14.17.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-12.22.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+11732+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+647+e905fa21"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+654+17ff1d38"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-1.42.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-6.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.46.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.18-1","0.1.18-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.10+ds1-2ubuntu1+esm1"}]}],"versions":["4.4.10+ds1-2","4.4.10+ds1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.10+ds1-2ubuntu1+esm1"}]}],"versions":["4.4.10+ds1-2","4.4.10+ds1-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5}],"products":[{"vendor":"isaacs","product":"node-tar"},{"vendor":"npm","product":"node-tar"},{"vendor":"oracle","product":"graalvm"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"tar_project","product":"tar"}],"references":[{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.npmjs.com/advisories/1771","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","advisory","web","report"]},{"url":"https://www.npmjs.com/package/tar","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32803","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/46fe35083e2676e31c4e0a81639dce6da7aaa356","tags":["web"]},{"url":"https://github.com/isaacs/node-tar/commit/5987d9a41f6bfbf1ddab1098e1fdcf1a5618f571","tags":["web"]},{"url":"https://github.com/isaacs/node-tar/commit/85d3a942b4064e4ff171f91696fced7975167349","tags":["web"]},{"url":"https://github.com/isaacs/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r628-mhmh-qjhw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-32803","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3623","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993039","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993927","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3623.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22930","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22931","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22939","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22940","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-23343","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32803","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32804","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3672","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3666","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1993924","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3666.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-32803","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32803","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0103.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29656","tags":["report"]},{"url":"https://www.debian.org/security/2021/dsa-5008","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3280","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3280.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3672","tags":["advisory"]},{"url":"https://c-ares.haxx.se/adv_20210810.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22931","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22940","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32803","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3281","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3281.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3623.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3638","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3638.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22918","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27290","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3639","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3639.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993924","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3666.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3623","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3666","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220531-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191962","tags":["report"]},{"url":"https://bugzilla.suse.com/1191963","tags":["report"]},{"url":"https://bugzilla.suse.com/1192153","tags":["report"]},{"url":"https://bugzilla.suse.com/1192154","tags":["report"]},{"url":"https://bugzilla.suse.com/1192696","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3918","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220563-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220569-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220570-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21824","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220657-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220704-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220715-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194819","tags":["report"]},{"url":"https://bugzilla.suse.com/1197283","tags":["report"]},{"url":"https://bugzilla.suse.com/1198247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0235","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32803","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5283-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NCH4EEBMT6XZIRNVGTNBOCQCY4JVZ4IN/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VAM6LOV2R24IH5PPUWLXB64PALLMBOTU/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-32803","title":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","status":"published","published":"2021-08-03T19:05:12Z","modified":"2024-08-03T23:33:56.082Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-1856","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","status":"published","published":"2021-08-03T19:05:12Z","modified":"2024-08-03T23:33:56Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:35.30045Z"}],"ghsa":[{"id":"GHSA-r628-mhmh-qjhw","title":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning","description":"### Impact\n\nArbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution\n\n`node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks.  Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created.\n\nThis logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur.\n\nBy first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.\n\nThis issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.\n\n### Patches\n\n3.2.3 || 4.4.15 || 5.0.7 || 6.1.2\n\n### Workarounds\n\nUsers may work around this vulnerability without upgrading by creating a custom `filter` method which prevents the extraction of symbolic links.\n\n```js\nconst tar = require('tar')\n\ntar.x({\n  file: 'archive.tgz',\n  filter: (file, entry) =\u003e {\n    if (entry.type === 'SymbolicLink') {\n      return false\n    } else {\n      return true\n    }\n  }\n})\n```\n\nUsers are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.","status":"published","published":"2021-08-03T19:00:40Z","modified":"2024-01-26T20:00:13Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-23","CWE-59"],"updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2021-32803","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","status":"published","published":"2021-08-03T19:15:08.297Z","modified":"2026-06-17T03:53:39.603Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:06:56.562207Z"}],"osv":[{"id":"ALPINE-CVE-2021-32803","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","status":"withdrawn","published":"2021-08-03T19:15:08.297Z","modified":"2026-07-14T08:03:28.437538919Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-32803","title":"CVE-2021-32803 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:26.128684Z","modified":"2026-01-26T09:48:31.146063Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-32803","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","status":"published","published":"2021-08-03T19:15:08.297Z","modified":"2026-10-24T10:50:41.660024595Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32803","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","status":"published","published":"2021-08-03T19:15:08.297Z","modified":"2026-10-23T18:03:14.186779578Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-r628-mhmh-qjhw","title":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning","description":"### Impact\n\nArbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution\n\n`node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks.  Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created.\n\nThis logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur.\n\nBy first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.\n\nThis issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.\n\n### Patches\n\n3.2.3 || 4.4.15 || 5.0.7 || 6.1.2\n\n### Workarounds\n\nUsers may work around this vulnerability without upgrading by creating a custom `filter` method which prevents the extraction of symbolic links.\n\n```js\nconst tar = require('tar')\n\ntar.x({\n  file: 'archive.tgz',\n  filter: (file, entry) =\u003e {\n    if (entry.type === 'SymbolicLink') {\n      return false\n    } else {\n      return true\n    }\n  }\n})\n```\n\nUsers are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.","status":"published","published":"2021-08-03T19:00:40Z","modified":"2026-07-08T06:27:29.457953694Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-23","CWE-59"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RHSA-2021:3280","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:46:18Z","modified":"2026-10-14T10:01:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3281","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:45:36Z","modified":"2026-10-14T10:01:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3623","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:49Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3638","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:56Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3639","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:53:03Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3666","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-10-21T23:53:10Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-02-05T14:15:09.755984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-02-04T13:45:08.983202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-32803","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","status":"published","published":"2021-08-03T19:15:00Z","modified":"2026-02-04T03:40:07.595924Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"ALSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-10-29T11:00:08.534665993Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-10-29T11:00:46.249046474Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1775176089","title":"TuxCare security update for tar (1 CVE)","description":"TuxCare rebuilt tar to address 1 CVE. Fixed in 6.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:45:42.910161887Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1787823934","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 6.0.2-tuxcare.1.","status":"withdrawn","published":"2026-08-27T09:45:34Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792164455","title":"TuxCare security update for tar (1 CVE)","description":"TuxCare rebuilt tar to address 1 CVE. Fixed in 6.1.0-tuxcare.1.","status":"published","published":"2026-10-16T15:27:35Z","modified":"2026-10-16T16:32:00.360721659Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"MGASA-2022-0103","title":"Updated nodejs-tar packages fix security vulnerability","description":"Untrusted tar file to symlink into an arbitrary  location allowing file\noverwrites. (CVE-2021-37712)\n\nArbitrary file creation/overwrite and arbitrary code execution.\n(CVE-2021-37701)\n\nArbitrary File Creation/Overwrite vulnerability via insufficient symlink\nprotection. (CVE-2021-32803)\n\nArbitrary File Creation/Overwrite vulnerability due to insufficient\nabsolute path sanitization (CVE-2021-32804)\n","status":"published","published":"2022-03-21T20:18:30Z","modified":"2026-04-16T04:41:25.043448406Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0657-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\t  \n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-02T09:11:57Z","modified":"2025-05-07T18:12:33.759789Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0704-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-03T17:26:35Z","modified":"2026-02-04T02:52:06.44142Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0715-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-04T08:37:55Z","modified":"2026-02-04T02:33:56.661005Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"ROOT-APP-NPM-CVE-2021-32803","title":"CVE-2021-32803 in tar - Patched by Root","description":"Root has patched CVE-2021-32803 in the tar package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T08:46:27Z","modified":"2026-10-07T09:15:04.119820608Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2022:0531-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).                                                                                                                                                 \n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).                                                                                                           \n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).                                                                                                   \n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).                                                                                                                        \n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-02-21T08:23:42Z","modified":"2026-02-04T03:55:02.611Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0563-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\t  \n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-02-24T07:38:40Z","modified":"2025-05-02T04:31:10.932136Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0569-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-02-24T09:35:23Z","modified":"2026-02-04T02:49:10.230021Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0570-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).                                                                                                                                                 \n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).                                                                                                           \n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).                                                                                                   \n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n- CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).\n","status":"published","published":"2022-02-24T09:35:40Z","modified":"2026-02-04T02:12:56.410668Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0657-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\t  \n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-02T09:12:22Z","modified":"2026-02-04T04:16:38.652115Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0704-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-03T17:27:07Z","modified":"2026-02-04T02:49:38.423844Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0715-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-04T08:38:26Z","modified":"2026-02-04T02:41:24.339909Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1717-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n- CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).\n- CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).\n- CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).\n- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).\n","status":"published","published":"2022-05-17T15:43:16Z","modified":"2026-02-04T02:37:21.561016Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5283-1","title":"node-tar vulnerability","description":"It was discovered that Tar for Node.js did not properly sanitize path inputs.\nAn attacker could possibly use this issue to read arbitrary files, resulting\nin a directory traversal attack.\n","status":"published","published":"2022-02-11T14:43:32Z","modified":"2026-04-27T16:02:26.142764Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}