npm tar

Name: npm tar
Brand: npm

productUS

pkg:npm/tar

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

unpatched

critical

by severity

0critical11high5medium0low

updated 2026-10-25

vulnerabilities (21)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-32804US	high8.1	15.1% (97th)	Exploit	5.0.6	2021-08-03	4 versions
CVE-2026-29786US	medium6.3	0.40% (33rd)	Exploit	7.5.10	2026-03-07	< 7.5.10
CVE-2026-23745US	medium6.1	0.38% (30th)	Exploit	7.5.3	2026-01-16	< 7.5.3
CVE-2026-31802US	medium5.5	0.19% (8th)	Exploit	7.5.11	2026-03-10	< 7.5.11
CVE-2021-32803US	high8.1	7.80% (95th)	—	6.1.2	2021-08-03	4 versions
CVE-2015-8860US	high7.5	4.00% (90th)	—	2.0.0	2017-01-23	< 2.0.0
CVE-2021-37701US	high8.6	3.29% (88th)	—	6.1.7	2021-08-31	3 versions
CVE-2018-20834US	high7.5	3.15% (88th)	—	4.4.2	2019-04-30	2 versions
CVE-2021-37712US	high8.6	1.86% (79th)	—	4.4.18	2021-08-31	3 versions
CVE-2021-37713US	high8.6	1.27% (70th)	—	5.0.10	2021-08-31	3 versions
CVE-2024-28863US	—	0.93% (60th)	—	6.2.1	2024-03-21	< 6.2.1
CVE-2026-59871US	high7.5	0.64% (50th)	—	7.5.18	2026-07-08	< 7.5.18
CVE-2026-24842US	—	0.62% (49th)	—	7.5.7	2026-01-28	< 7.5.7
CVE-2026-59873US	high7.5	0.58% (47th)	—	7.5.19	2026-07-08	< 7.5.19
CVE-2026-73566US	—	0.53% (44th)	—	7.5.21	2026-08-13	< 7.5.21
CVE-2026-59875US	—	0.51% (42nd)	—	7.5.17	2026-07-08	< 7.5.17
CVE-2026-59874US	high7.5	0.43% (37th)	—	7.5.18	2026-07-08	< 7.5.18
CVE-2026-23950US	medium5.9	0.26% (17th)	—	7.5.4	2026-01-20	< 7.5.4
CVE-2026-26960US	high7.1	0.23% (13th)	—	7.5.8	2026-02-20	< 7.5.8
CVE-2026-53655US	medium5.5	0.16% (4th)	—	7.5.16	2026-06-22	< 7.5.16
CVE-2025-64118US	—	0.13% (3rd)	—	7.5.2	2025-10-30	7.5.1 → 7.5.2

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')10 CVEs
CWE-59Improper Link Resolution Before File Access ('Link Following')8 CVEs
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition2 CVEs
CWE-400Uncontrolled Resource Consumption2 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs
CWE-176Improper Handling of Unicode Encoding1 CVEs
CWE-23Relative Path Traversal1 CVEs
CWE-248Uncaught Exception1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.