Junglewise Threat Intelligence

CVE-2025-64118: node-tar sync list race condition memory exposure

CVE-2025-64118 · Severity: medium · CVSS 4 · Published 2025-10-30

Vendors: npm.

Executive brief

node-tar is a popular Node.js library for reading and writing tar archive files. A race condition in version 7.5.1 can leak uninitialized memory (which may contain sensitive data like environment variables or file contents) if an attacker can truncate a tar file on disk at precisely the right moment while the application is reading it. The vulnerability requires specific conditions: synchronous list mode, file system access to truncate the tar file, and application code that processes tar entry contents. Earlier and later versions are not affected.

Technical details

This is a race condition (CWE-362) in the synchronous tar.list() method introduced in commit 5330eb0. When reading a tar file synchronously, the code calls fs.stat() to determine file size, then allocates a buffer of that size and calls fs.readSync(). However, between the stat() and readSync() calls, an attacker can truncate the tar file to a smaller size. The vulnerable code fails to use the return value from readSync() to determine how many bytes were actually read, instead returning the entire pre-allocated buffer which contains uninitialized memory. This uninitialized memory can expose sensitive data. The attack requires: (1) the application uses tar.t({sync: true}) with onReadEntry processing, (2) attacker can truncate the tar file on disk, and (3) truncation must occur at a tar header/body boundary. The vulnerability is fixed in version 7.5.2 by properly using the readSync() return value to truncate the buffer. Other tar methods (extract, create) are not affected.

Affected products

  • npm tar 7.5.1

Timeline

  • 2025-10-30: disclosed: GHSA-29xp-372q-xqph published
  • 2025-10-30: patched: Fixed in tar 7.5.2

References