IS
Vendor
isaacs
31
CVEs
0
On KEV
0
New 30D
Products
NO8.2
node-tar
isaacs
13 CVEs0 on KEV0 new
TA8.2
Tar
Isaacs
12 CVEs0 on KEV0 new
MI7.5
minimatch
isaacs
3 CVEs0 on KEV0 new
BR9.2
brace-expansion
isaacs
1 CVEs0 on KEV0 new
GL7.5
Glob
Isaacs
1 CVEs0 on KEV0 new
NO7.5
node-glob
isaacs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73566 | NO node-tar isaacs | 7.5 | Aug 13 | node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection |
| CVE-2026-59871 | NO node-tar isaacs | 7.5 | Jul 8 | node-tar: Process crash via PAX numeric path type confusion |
| CVE-2026-59874 | NO node-tar isaacs | 7.5 | Jul 8 | node-tar: Negative tar entry size causes infinite loop in archive replace |
| CVE-2026-59873 | NO node-tar isaacs | 7.5 | Jul 8 | node-tar: Decompression/parse DoS via unlimited input |
| CVE-2026-59875 | NO node-tar isaacs | 5.3 | Jul 8 | node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records |
| CVE-2026-53655 | NO node-tar isaacs | 5.5 | Jun 22 | node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) |
| CVE-2026-31802 | NO node-tar isaacs | 5.5 | Mar 9 | node-tar Symlink Path Traversal via Drive-Relative Linkpath |
| CVE-2026-29786 | NO node-tar isaacs | 6.3 | Mar 7 | node-tar: Hardlink Path Traversal via Drive-Relative Linkpath |
| CVE-2026-27904 | MI minimatch isaacs | 7.5 | Feb 26 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
| CVE-2026-27903 | MI minimatch isaacs | 7.5 | Feb 26 | minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
| CVE-2026-26996 | MI minimatch isaacs | 7.5 | Feb 20 | minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
| CVE-2026-26960 | NO node-tar isaacs | 7.1 | Feb 20 | node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction |
| CVE-2026-25547 | BR brace-expansion isaacs | 9.2 | Feb 4 | Uncontrolled Resource Consumption in @isaacs/brace-expansion |
| CVE-2026-24842 | NO node-tar isaacs | 8.2 | Jan 28 | node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal |
| CVE-2026-23950 | NO node-tar isaacs | 5.9 | Jan 20 | node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS |
| CVE-2026-23745 | NO node-tar isaacs | 6.1 | Jan 16 | node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization |
| CVE-2025-64756 | NO node-glob isaacs | 7.5 | Nov 17 | glob CLI: Command injection via -c/--cmd executes matches with shell:true |
| CVE-2025-64118 | NO node-tar isaacs | 6.1 | Oct 30 | node-tar vulnerable to race condition leading to uninitialized memory exposure |
| CVE-2024-28863 | TA Tar Isaacs | 6.5 | Mar 21 | node-tar is a Tar for Node.js |
| CVE-2018-20834 | TA Tar Isaacs | 7.5 | Apr 30 | A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2) |