isaacs vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20252
3. 202618

Newest CVEs

• CVE-2026-118773

  Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

  isaacs · node-glob

  Medium6.3
• CVE-2026-118764

  minimatch: potential denial of service via globparts amplification

  isaacs · minimatch

  Medium6.9
• CVE-2026-73566

  node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

  isaacs · node-tar

  High7.5
• CVE-2026-59871

  node-tar: Process crash via PAX numeric path type confusion

  isaacs · node-tar

  Medium5.3
• CVE-2026-59874

  node-tar: Negative tar entry size causes infinite loop in archive replace

  isaacs · node-tar

  High8.7
• CVE-2026-59873

  node-tar: Decompression/parse DoS via unlimited input

  isaacs · node-tar

  Critical9.2
• CVE-2026-59875

  node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

  isaacs · node-tar

  Medium5.3
• CVE-2026-53655

  node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

  isaacs · node-tar

  Medium6.9
• CVE-2026-31802

  node-tar Symlink Path Traversal via Drive-Relative Linkpath

  isaacs · node-tar

  High8.2
• CVE-2026-29786

  node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

  isaacs · node-tar

  High8.2