{"id":"CVE-2021-32804","aliases":["ALPINE-CVE-2021-32804","ALSA-2021:3623","ALSA-2021:3666","BELL-CVE-2021-32804","CLSA-2026-1773188129","CLSA-2026-1773620217","CLSA-2026-1774484514","CLSA-2026-1775176096","CLSA-2026-1777941831","CLSA-2026-1793364175","DEBIAN-CVE-2021-32804","EUVD-2021-1548","GHSA-3jfq-g458-7qm9","MGASA-2022-0103","RHSA-2021:3280","RHSA-2021:3281","RHSA-2021:3623","RHSA-2021:3638","RHSA-2021:3639","RHSA-2021:3666","RLSA-2021:3623","RLSA-2021:3666","ROOT-APP-NPM-CVE-2021-32804","SUSE-SU-2022:0531-1","SUSE-SU-2022:0563-1","SUSE-SU-2022:0569-1","SUSE-SU-2022:0570-1","SUSE-SU-2022:0657-1","SUSE-SU-2022:0704-1","SUSE-SU-2022:0715-1","SUSE-SU-2022:1717-1","UBUNTU-CVE-2021-32804","openSUSE-SU-2022:0657-1","openSUSE-SU-2022:0704-1","openSUSE-SU-2022:0715-1"],"status":"published","title":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.15067,"percentile":0.96755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2021-08-03T19:06:36Z","modified":"2026-10-30T19:45:14Z","exploits":[{"source":"pocgithub","id":"yamory/CVE-2021-32804","title":"yamory/CVE-2021-32804","date":"2021-08-31","url":"https://github.com/yamory/CVE-2021-32804"},{"source":"pocgithub","id":"federiconbaez/cortex9-node-tar-path-sanitization-model","title":"federiconbaez/cortex9-node-tar-path-sanitization-model","date":"2026-11-06","url":"https://github.com/federiconbaez/cortex9-node-tar-path-sanitization-model"}],"fixes":[{"ecosystem":"npm","package":"tar","fixed_in":["3.2.2","4.4.14","5.0.6","6.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"tar","fixed_in":["6.0.2-tuxcare.2","2.2.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-tar","fixed_in":["6.1.7+~cs11.3.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-tar","fixed_in":["6.1.7+~cs11.3.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tar","fixed_in":["6.1.7+~cs11.3.10-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar","fixed_in":["4.4.13-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar","fixed_in":["4.4.13-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3-tuxcare.0"},{"fixed":"1.0.3-tuxcare.1"}]}],"versions":["1.0.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-tuxcare.0"},{"fixed":"2.1.1-tuxcare.1"}]}],"versions":["2.1.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2-tuxcare.0"},{"fixed":"6.0.2-tuxcare.2"}]}],"versions":["6.0.2","6.0.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.1"}]}],"versions":["2.2.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0-tuxcare.0"},{"fixed":"6.1.0-tuxcare.4"}]}],"versions":["6.1.0","6.1.0-tuxcare.1","6.1.0-tuxcare.2","6.1.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.7+~cs11.3.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.7+~cs11.3.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.7+~cs11.3.10-1"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.4.14"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.1.1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.5-1.1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-14.17.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-12.22.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+11732+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+647+e905fa21"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+654+17ff1d38"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-1.42.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.54.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-6.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.46.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.18-1","0.1.18-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-2","1.0.3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.10+ds1-2","4.4.10+ds1-2ubuntu1","4.4.10+ds1-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.7+~cs11.3.10-1","6.1.11+~cs11.3.10-1","6.1.11+ds1+~cs6.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.13+~cs7.0.5-1","6.1.13+~cs7.0.5-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+ds1+~cs6.1.13-10","7.5.22+~4.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-10"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.10-4.29.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.19.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.0-15.27.1"}]}],"bundled":5}],"products":[{"vendor":"isaacs","product":"node-tar"},{"vendor":"npm","product":"node-tar"},{"vendor":"oracle","product":"graalvm"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"tar_project","product":"tar"}],"references":[{"url":"https://www.npmjs.com/package/tar","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.npmjs.com/advisories/1770","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","advisory","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3jfq-g458-7qm9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-32804","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3623","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993039","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993927","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3623.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22930","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22931","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22939","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22940","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-23343","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32803","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32804","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3672","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3666","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1993924","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3666.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-32804","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32804","tags":["advisory"]},{"url":"https://github.com/npm/node-tar","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0103.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29656","tags":["report"]},{"url":"https://www.debian.org/security/2021/dsa-5008","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3280","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3280.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3672","tags":["advisory"]},{"url":"https://c-ares.haxx.se/adv_20210810.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22931","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22940","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32803","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32804","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3281","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3281.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3623.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3638","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3638.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22918","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27290","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3639","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3639.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993924","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3666.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3623","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3666","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220531-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191962","tags":["report"]},{"url":"https://bugzilla.suse.com/1191963","tags":["report"]},{"url":"https://bugzilla.suse.com/1192153","tags":["report"]},{"url":"https://bugzilla.suse.com/1192154","tags":["report"]},{"url":"https://bugzilla.suse.com/1192696","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3918","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220563-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220569-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220570-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21824","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220657-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220704-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220715-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194819","tags":["report"]},{"url":"https://bugzilla.suse.com/1197283","tags":["report"]},{"url":"https://bugzilla.suse.com/1198247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0235","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32804","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NCH4EEBMT6XZIRNVGTNBOCQCY4JVZ4IN/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VAM6LOV2R24IH5PPUWLXB64PALLMBOTU/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-32804","title":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","status":"published","published":"2021-08-03T19:10:12Z","modified":"2024-08-03T23:33:56.07Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-1548","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","status":"published","published":"2021-08-03T19:10:12Z","modified":"2024-08-03T23:33:56Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:35.30045Z"}],"ghsa":[{"id":"GHSA-3jfq-g458-7qm9","title":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization","description":"### Impact\n\nArbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution\n\n`node-tar` aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. \n\nThis logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. \n\n### Patches\n\n3.2.2 || 4.4.14 || 5.0.6 || 6.1.1\n\nNOTE: an adjacent issue [CVE-2021-32803](https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw) affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your `node-tar` use case.\n\n### Workarounds\n\nUsers may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths.\n\n```js\nconst path = require('path')\nconst tar = require('tar')\n\ntar.x({\n  file: 'archive.tgz',\n  // either add this function...\n  onentry: (entry) =\u003e {\n    if (path.isAbsolute(entry.path)) {\n      entry.path = sanitizeAbsolutePathSomehow(entry.path)\n      entry.absolute = path.resolve(entry.path)\n    }\n  },\n\n  // or this one\n  filter: (file, entry) =\u003e {\n    if (path.isAbsolute(entry.path)) {\n      return false\n    } else {\n      return true\n    }\n  }\n})\n```\n\nUsers are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.","status":"published","published":"2021-08-03T19:06:36Z","modified":"2023-02-01T05:05:55Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","status":"published","published":"2021-08-03T19:15:08.41Z","modified":"2026-06-17T03:53:39.76Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:56.562207Z"}],"osv":[{"id":"ALPINE-CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","status":"withdrawn","published":"2021-08-03T19:15:08.41Z","modified":"2026-07-14T08:03:28.427627582Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-32804","title":"CVE-2021-32804 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:32.381648Z","modified":"2026-01-26T09:45:55.849048Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","status":"published","published":"2021-08-03T19:15:08.41Z","modified":"2026-10-24T10:50:24.396888826Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","status":"published","published":"2021-08-03T19:15:08.41Z","modified":"2026-10-23T18:03:37.675106443Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-3jfq-g458-7qm9","title":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization","description":"### Impact\n\nArbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution\n\n`node-tar` aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. \n\nThis logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. \n\n### Patches\n\n3.2.2 || 4.4.14 || 5.0.6 || 6.1.1\n\nNOTE: an adjacent issue [CVE-2021-32803](https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw) affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your `node-tar` use case.\n\n### Workarounds\n\nUsers may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths.\n\n```js\nconst path = require('path')\nconst tar = require('tar')\n\ntar.x({\n  file: 'archive.tgz',\n  // either add this function...\n  onentry: (entry) =\u003e {\n    if (path.isAbsolute(entry.path)) {\n      entry.path = sanitizeAbsolutePathSomehow(entry.path)\n      entry.absolute = path.resolve(entry.path)\n    }\n  },\n\n  // or this one\n  filter: (file, entry) =\u003e {\n    if (path.isAbsolute(entry.path)) {\n      return false\n    } else {\n      return true\n    }\n  }\n})\n```\n\nUsers are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.","status":"published","published":"2021-08-03T19:06:36Z","modified":"2026-07-08T06:28:51.409971286Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RHSA-2021:3280","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:46:18Z","modified":"2026-10-14T10:01:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3281","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:45:36Z","modified":"2026-10-14T10:01:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3623","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:49Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3638","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:56Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3639","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:53:03Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3666","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-10-21T23:53:10Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-02-05T14:15:09.755984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-02-04T13:45:08.983202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","status":"published","published":"2021-08-03T19:15:00Z","modified":"2026-10-17T12:55:46.61447315Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"ALSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-10-29T11:00:08.534665993Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-10-29T11:00:46.249046474Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1773188129","title":"TuxCare security update for tar (7 CVEs)","description":"TuxCare rebuilt tar to address 7 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.769618678Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773620217","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 1.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-23T19:28:13.603540691Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774484514","title":"TuxCare security update for tar (5 CVEs)","description":"TuxCare rebuilt tar to address 5 CVEs. Fixed in 2.1.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:04.625520498Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775176096","title":"TuxCare security update for tar (1 CVE)","description":"TuxCare rebuilt tar to address 1 CVE. Fixed in 6.0.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T19:13:04.557967601Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777941831","title":"TuxCare security update for tar (1 CVE)","description":"TuxCare rebuilt tar to address 1 CVE. Fixed in 2.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:45:49.595520306Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1793364175","title":"TuxCare security update for tar (2 CVEs)","description":"TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.1.0-tuxcare.4.","status":"published","published":"2026-10-30T13:42:56Z","modified":"2026-10-30T19:45:14.613315479Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"MGASA-2022-0103","title":"Updated nodejs-tar packages fix security vulnerability","description":"Untrusted tar file to symlink into an arbitrary  location allowing file\noverwrites. (CVE-2021-37712)\n\nArbitrary file creation/overwrite and arbitrary code execution.\n(CVE-2021-37701)\n\nArbitrary File Creation/Overwrite vulnerability via insufficient symlink\nprotection. (CVE-2021-32803)\n\nArbitrary File Creation/Overwrite vulnerability due to insufficient\nabsolute path sanitization (CVE-2021-32804)\n","status":"published","published":"2022-03-21T20:18:30Z","modified":"2026-04-16T04:41:25.043448406Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0657-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\t  \n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-02T09:11:57Z","modified":"2025-05-07T18:12:33.759789Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0704-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-03T17:26:35Z","modified":"2026-02-04T02:52:06.44142Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0715-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-04T08:37:55Z","modified":"2026-02-04T02:33:56.661005Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"ROOT-APP-NPM-CVE-2021-32804","title":"CVE-2021-32804 in tar - Patched by Root","description":"Root has patched CVE-2021-32804 in the tar package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T08:46:27Z","modified":"2026-10-07T09:15:05.172589841Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2022:0531-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).                                                                                                                                                 \n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).                                                                                                           \n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).                                                                                                   \n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).                                                                                                                        \n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-02-21T08:23:42Z","modified":"2026-02-04T03:55:02.611Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0563-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\t  \n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-02-24T07:38:40Z","modified":"2025-05-02T04:31:10.932136Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0569-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-02-24T09:35:23Z","modified":"2026-02-04T02:49:10.230021Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0570-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).                                                                                                                                                 \n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).                                                                                                           \n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).                                                                                                   \n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n- CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).\n","status":"published","published":"2022-02-24T09:35:40Z","modified":"2026-02-04T02:12:56.410668Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0657-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\t  \n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-02T09:12:22Z","modified":"2026-02-04T04:16:38.652115Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0704-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-03T17:27:07Z","modified":"2026-02-04T02:49:38.423844Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0715-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n","status":"published","published":"2022-03-04T08:38:26Z","modified":"2026-02-04T02:41:24.339909Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1717-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n- CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).\n- CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).\n- CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).\n- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).\n","status":"published","published":"2022-05-17T15:43:16Z","modified":"2026-02-04T02:37:21.561016Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}