node-tar CVE-2025-64118

Exploitation requires ALL of the following: (1) the victim application uses node-tar 7.5.1 and calls .t() / .list() with { sync: true } to read entry contents; (2) an attacker-controlled local process can concurrently modify the same tar file on disk, truncating it to a smaller size at the boundary between a tar header and body block; (3) the truncation must land in the narrow race window between when the archive size is obtained via stat and when the synchronous parser reaches the truncated entry. Limiting factors that reduce real-world risk: the vector is local (AV:L) and requires a precise, high-complexity timing race (AC:H / AT:P), only the sync list path is affected (async/streaming and extraction paths are not implicated by the advisory), the PoC demonstrates the condition specifically on Node.js 22 or >= 25.1.0, and a mismatched truncation boundary typically yields a parse error (strict mode) or a skipped entry rather than a clean leak. Not exploitable against default remote/unauthenticated usage.

This is a genuine but low-priority issue whose signals are largely consistent in pointing to limited real-world risk. The input CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:P) describes a local, high-complexity attack with a present attack requirement (AT:P), partial privileges, and passive user interaction - i.e. an attacker must win a tight timing race on the same host, which the GHSA advisory confirms: the file must be truncated precisely between the stat() size read and the moment the parser reaches that entry. EPSS reinforces this, at 0.13% (3rd percentile), indicating very low predicted exploitation despite a publicly available PoC. There is NO CISA KEV listing, so this is not confirmed as actively exploited. The confidentiality impact is real (VC:H - uninitialized process memory can leak passwords, env vars, or unrelated file contents), but exploitation is probabilistic and non-deterministic even for a local attacker. No SSVC decision data was provided in the input. Net: a confirmed information-disclosure bug with a real PoC, but high attack complexity, local-only vector, and very low EPSS make this a patch-on-normal-cycle item rather than an emergency - the main nuance is that the affected library (npm/tar) is ubiquitous, so the installed base is enormous even though the vulnerable code path (.list with sync:true under a concurrent truncation race) is narrow.

A local attacker (or malicious/compromised co-located process) repeatedly rewrites and truncates a tar archive on disk while a victim Node.js process calls tar.t({sync:true}) to list/read that archive's entries. By shrinking the file at a header/body block boundary in the race window between the size stat and the parser read, the attacker causes node-tar to emit uninitialized heap memory as entry data, leaking process secrets. A working two-script PoC (producer that truncates in a loop, consumer that lists and dumps non-zero bytes) is published in the GHSA advisory.