Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-28863 EUVD-2024-0909GHSA-f5x3-32g6-xq36

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

Published Mar 21, 2024 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: isaacs Product: node-tar Package: jupyter-base-notebook Package: lerna Package: node-tar Package: node-tar Package: node-tar Package: nodejs Package: nodejs18 Package: npm Package: pnpm-stage0 Package: py3.10-jupyterlab Package: py3.11-jupyterlab Package: py3.12-jupyterlab Package: py3.13-jupyterlab Package: reaper Package: sqlpad Package: tar Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu Ecosystem: Wolfi

Description

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Affected products

VendorProductAffectedFixed
isaacs node-tar < 6.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-tar 6.1.13+~cs7.0.5-2 —
Debian 13 node-tar 6.1.13+~cs7.0.5-2 —
Debian 12 node-tar 6.1.13+~cs7.0.5-1+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS node-tar No fix yet —
Ubuntu 22.04 LTS node-tar No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS node-tar No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 nodejs +3 1:18.20.4-1.module+el9.4.0+22195+c221878e RHSA-2024:6147
RHEL 9 nodejs-nodemon 3.0.1-1.module+el9.3.0+19762+d716bf3b RHSA-2024:6147
RHEL 9 nodejs-packaging +1 2021.06-4.module+el9.1.0+15718+e52ec601 RHSA-2024:6147
RHEL 9 npm 1:10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e RHSA-2024:6147
RHEL 8 nodejs +3 1:18.20.4-1.module+el8.10.0+22199+56ea0ead RHSA-2024:6148, RHSA-2024:5814
RHEL 8 nodejs-nodemon 3.0.1-1.module+el8.9.0+20473+c4e3d824 RHSA-2024:6148, RHSA-2024:5814
RHEL 8 nodejs-packaging +1 2021.06-4.module+el8.9.0+19439+7b18b275 RHSA-2024:6148, RHSA-2024:5814
RHEL 8 npm 1:10.7.0-1.18.20.4.1.module+el8.10.0+22199+56ea0ead RHSA-2024:6148, RHSA-2024:5814
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 foreman +1 3.12.0.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite 4.2.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite_operations 3.0.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansible-lint 5.4.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 ansible-runner +1 2.2.1-6.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansiblerole-foreman_scap_client 0.3.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 cjson 1.7.17-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 createrepo_c +3 1.1.3-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 dynflow-utils 1.6.3-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman +2 3.12.0.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202102220000-3.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-discovery-image 1:4.1.0-61.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-4.1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-fapolicyd +1 1.0.1-3.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-installer +1 1:3.12.0.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-proxy +1 3.12.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 katello +3 4.14.0-0.1.rc2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 katello-certs-tools 2.10.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.9-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 libcomps +2 0.1.21-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 libsolv +1 1:0.7.20-6.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 mosquitto 2.0.19-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 pulpcore-obsolete-packages 1.2.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 pulpcore-selinux 2.0.1-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 puppet-agent 8.8.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.10-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 1.0.0-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppetlabs-stdlib 9.4.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppetserver 8.6.2-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiodns +1 3.0.0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiofiles +1 22.1.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiohttp +1 3.9.4-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiohttp-xmlrpc +1 1.5.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aioredis +1 2.0.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiosignal +1 1.3.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ansible-builder +1 3.0.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-asgiref +1 3.6.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-async-lru +1 1.0.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-async-timeout +1 4.0.2-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-asyncio-throttle +1 1.0.2-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-attrs +1 21.4.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-backoff +1 2.2.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bindep +1 2.11.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bleach +1 3.3.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bleach-allowlist +1 1.0.3-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bracex +1 2.2.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-brotli +1 1.0.9-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-certifi +1 2022.12.7-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-cffi +1 1.15.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-chardet +1 5.0.0-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-charset-normalizer +1 2.1.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-click +1 8.1.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-click-shell +1 2.1-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-colorama +1 0.4.4-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-commonmark +1 0.9.1-9.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-contextlib2 +1 21.6.0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-cryptography +1 42.0.8-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-daemon +1 2.3.1-3.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 python-dataclasses +1 0.8-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-dateutil +1 2.8.2-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-debian +1 0.1.44-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-defusedxml +1 0.7.1-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-deprecated +1 1.2.13-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-diff-match-patch +1 20200713-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-distro +1 1.7.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django +1 4.2.16-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-filter +1 23.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-guid +1 3.3.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-lifecycle +1 1.0.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-readonly-field +1 1.1.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-djangorestframework +1 3.14.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-djangorestframework-queryfields +1 1.0.0-8.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-docutils +1 0.20.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-drf-access-policy +1 1.3.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-drf-nested-routers +1 0.93.4-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-drf-spectacular +1 0.26.5-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-dynaconf +1 3.1.12-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ecdsa +1 0.18.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-enrich +1 1.2.6-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-et-xmlfile +1 1.1.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-flake8 +1 5.0.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-frozenlist +1 1.3.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-future +1 0.18.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-galaxy-importer +1 0.4.19-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gitdb +1 4.0.10-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gitpython +1 3.1.40-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gnupg +1 0.5.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-googleapis-common-protos +1 1.59.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-grpcio +1 1.65.4-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gunicorn +1 22.0.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-importlib-metadata +1 6.0.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-inflection +2 0.5.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-iniparse +1 0.4-39.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-jinja2 +1 3.1.4-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-jq +1 1.6.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-json-stream +1 2.3.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-json-stream-rs-tokenizer +1 0.4.25-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-jsonschema +1 4.10.3-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-lockfile +1 0.12.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-lxml +1 4.9.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-markdown +1 3.4.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-markuppy +1 1.14-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-markupsafe +1 2.1.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-mccabe +1 0.7.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-multidict +1 6.0.4-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-odfpy +1 1.4.1-9.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-openpyxl +3 3.1.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_api +2 1.19.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_distro +2 0.40b0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_exporter_otlp_proto_grpc +1 1.19.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_instrumentation 0.40b0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_instrumentation_wsgi +1 0.40b0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_sdk +3 1.19.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_util_http +1 0.40b0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-packaging 21.3-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-parsley 1.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pbr 5.8.0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pexpect 4.8.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pillow 10.3.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-productmd 1.33-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-protobuf 4.21.6-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-psycopg 3.1.9-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ptyprocess 0.7.0-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-ansible 1:0.21.8-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-cli +1 0.27.2-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-container 2.20.2-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-deb 3.2.1-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-file 1.15.1-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-rpm 3.26.1-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp_manifest 3.0.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulpcore 3.49.19-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyOpenSSL 24.1.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycares 4.1.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycodestyle 2.9.1-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycparser 2.21-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycryptodomex 3.20.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyflakes 2.5.0-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pygments 2.17.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyjwkest 1.4.2-8.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyjwt +1 2.5.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyparsing 3.1.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyrsistent 0.18.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pytz 2022.2.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-redis 4.3.4-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-requests 2.31.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-requirements-parser 0.2.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-rhsm 1.19.2-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-rich 13.3.1-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ruamel-yaml 0.17.21-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ruamel-yaml-clib 0.2.7-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-schema 0.7.5-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-semantic-version 2.10.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-six 1.16.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-smmap 5.0.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-solv 0.7.28-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-sqlparse 0.5.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-tablib 3.3.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-tenacity 7.0.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-toml 0.10.2-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-types-cryptography 3.3.23.2-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-typing-extensions 4.7.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-uritemplate 4.1.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-url-normalize 1.4.3-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-urllib3 2.2.3-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-urlman 2.0.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-uuid6 2023.5.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-wcmatch 8.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-whitenoise 6.0.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-wrapt 1.14.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-xlrd 2.0.1-8.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-xlwt 1.3.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-yarl 1.8.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-zipp +1 3.20.2-1.el8pc RHSA-2024:8906
Red Hat Satellite 6 foreman +14 3.12.0.1-1.el8sat RHSA-2024:8906
Red Hat Satellite 6 foreman-installer +1 1:3.12.0.1-1.el8sat RHSA-2024:8906
Red Hat Satellite 6 mosquitto 2.0.19-1.el8sat RHSA-2024:8906
Red Hat Satellite 6 python-grpcio +1 1.65.4-1.el8pc RHSA-2024:8906
Red Hat Satellite 6 python-zipp +1 3.20.2-1.el8pc RHSA-2024:8906

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 nodejs +3 1:18.20.4-1.module_el9.4.0+112+bb28ff81 ALSA-2024:6147
AlmaLinux 9 nodejs-nodemon 3.0.1-1.module_el9.2.0+36+853e48f5 ALSA-2024:6147
AlmaLinux 9 nodejs-packaging +1 2021.06-4.module_el9.1.0+13+d9a595ea ALSA-2024:6147
AlmaLinux 9 npm 1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81 ALSA-2024:6147
AlmaLinux 8 nodejs +3 1:18.20.4-1.module_el8.10.0+3890+5a092792 ALSA-2024:6148, ALSA-2024:5814
AlmaLinux 8 nodejs-nodemon 3.0.1-1.module_el8.8.0+3613+1ed8c91d ALSA-2024:6148, ALSA-2024:5814
AlmaLinux 8 nodejs-packaging +1 2021.06-4.module_el8.7.0+3343+ea2b7901 ALSA-2024:6148, ALSA-2024:5814
AlmaLinux 8 npm 1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792 ALSA-2024:6148, ALSA-2024:5814

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 nodejs-nodemon 3.0.1-1.module+el9.5.0+31770+0da7192d RLSA-2024:6147
Rocky Linux 9 nodejs-packaging 2021.06-4.module+el9.5.0+31770+0da7192d RLSA-2024:6147
Rocky Linux 8 nodejs 1:18.20.4-1.module+el8.10.0+1865+67d146ca RLSA-2024:6148, RLSA-2024:5814
Rocky Linux 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+1666+930e28e8 RLSA-2024:6148, RLSA-2024:5814
Rocky Linux 8 nodejs-packaging 2021.06-4.module+el8.10.0+1667+4a788d89 RLSA-2024:6148, RLSA-2024:5814

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs +4 1:18.20.4-1.amzn2023.0.1 ALAS2023-2024-766
Amazon Linux 2023 nodejs-npm 1:10.7.0-1.18.20.4.1.amzn2023.0.1 ALAS2023-2024-766
Amazon Linux 2023 nodejs20 +4 1:20.18.0-1.amzn2023.0.2 ALAS2023-2024-768
Amazon Linux 2023 nodejs20-npm 1:10.8.2-1.20.18.0.1.amzn2023.0.2 ALAS2023-2024-768
Amazon Linux 2023 v8-10.2-devel 3:10.2.154.26-1.18.20.4.1.amzn2023.0.1 ALAS2023-2024-766
Amazon Linux 2023 v8-11.3-devel 3:11.3.244.8-1.20.18.0.1.amzn2023.0.2 ALAS2023-2024-768

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nodejs 20.14.0-1 —
Azure Linux 2 (CBL-Mariner) nodejs18 18.20.3-1 —
Azure Linux 2 (CBL-Mariner) reaper 3.1.1-17 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 nodejs +3 1:18.20.4-1.module+el9.4.0+90400+35c5e203 ELSA-2024-6147
Oracle Linux 9 nodejs-nodemon 3.0.1-1.module+el9.3.0+90167+01064547 ELSA-2024-6147
Oracle Linux 9 nodejs-packaging +1 2021.06-4.module+el9.1.0+20762+f52d7401 ELSA-2024-6147
Oracle Linux 9 npm 1:10.7.0-1.18.20.4.1.module+el9.4.0+90400+35c5e203 ELSA-2024-6147
Oracle Linux 8 nodejs +3 1:18.20.4-1.module+el8.10.0+90402+68b79193 ELSA-2024-6148, ELSA-2024-5814
Oracle Linux 8 nodejs-nodemon 3.0.1-1.module+el8.9.0+90082+b6a613a6 ELSA-2024-6148, ELSA-2024-5814
Oracle Linux 8 nodejs-packaging +1 2021.06-4.module+el8.9.0+90082+b6a613a6 ELSA-2024-6148, ELSA-2024-5814
Oracle Linux 8 npm 1:10.7.0-1.18.20.4.1.module+el8.10.0+90402+68b79193 ELSA-2024-6148, ELSA-2024-5814

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jupyter-base-notebook 7.6.3-r2 —
Wolfi rolling lerna 8.1.3-r0 —
Wolfi rolling npm 10.5.1-r0 —
Wolfi rolling pnpm-stage0 8.7.4-r6 —
Wolfi rolling py3.10-jupyterlab +3 4.6.1-r1 —
Wolfi rolling sqlpad 7.4.1-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm node-tar < 6.2.1 6.2.1 GHSA-f5x3-32g6-xq36
npm tar < 6.2.1 6.2.1 GHSA-f5x3-32g6-xq36

Advisories 16

References