Debian Patches
Status for node-tar/6.1.13+~cs7.0.5-1+deb12u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| api-backward-compatibility.patch | expose old method names for backward compatibility | Jérémy Lal <kapouer@melix.org> | not-needed | 2018-06-08 | ||
| CVE-2024-28863.patch | prevent extraction in excessively deep subfolders This sets the limit at 1024 subfolders nesting by default, but that can be dropped down, or set to Infinity to remove the limitation. |
isaacs <i@izs.me> | yes | upstream | https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7 | 2024-03-15 |
| fix-tests.patch | remove parallelism causing test/pack.js to be flaky | isaacs <i@izs.me> | no | 2023-05-12 | ||
| CVE-2026-23745.patch | fix: sanitize absolute linkpaths properly | isaacs <i@izs.me> | yes | upstream | https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e | 2026-01-16 |
| CVE-2026-23745-regression-fix.patch | fix: do not prevent valid linkpaths within archive EDIT(@isaacs): fixed for test coverage and to disallow absolute linkpaths that contain `..` |
Nathan Sarang-Walters <nwalters512@gmail.com> | yes | upstream | https://github.com/isaacs/node-tar/commit/e9a1ddb821b29ddee75b9470dd511066148c8070 | 2026-01-20 |
| CVE-2026-24842.patch | fix: properly sanitize hard links containing .. The issue here is that *hard* links are resolved relative to the unpack cwd, so if they have `..`, they cannot possibly be valid, same as files and for the same reason. The loosening of this restriction for symbolic links should have been limited by type, allowing this error. |
isaacs <i@izs.me> | yes | upstream | https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46 | 2026-01-27 |
| CVE-2026-26960-1.patch | fix: do not write linkpaths through symlinks Prevent any `Link` or `SymbolicLink` entry from being created if its `linkpath` would target a location that is through a symbolic link from the current working directory. This matches the behavior of `bsdtar` for hard links, and is somewhat more restrictive in applying the same logic to symbolic links as well. Unpacking links with targets that extend through symlink folders is allowed if `preservePaths` option is enabled, as this disables all protective link checking by design, and is only designed for use with trusted input. |
isaacs <i@izs.me> | yes | upstream | https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f | 2026-02-12 |
| CVE-2026-26960-2.patch | fix(unpack): improve UnpackSync symlink error "into" path accuracy UnpackSync[ENSURE_NO_SYMLINK] previously constructed SymlinkError's "into" path using the full original linkpath parts array, which could produce misleading diagnostics. Build the "into" path from the original `cwd` value and the `parts` list. |
Guillermo de Angel <scumfrog@users.noreply.github.com> | yes | upstream | https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384 | 2026-02-13 |
| CVE-2026-29786.patch | parse root off paths before sanitizing .. parts | isaacs <i@izs.me> | yes | upstream | https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f | 2026-03-04 |
| CVE-2026-31802.patch | prevent escaping symlinks with drive-relative paths | isaacs <i@izs.me> | yes | upstream | https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad | 2026-03-08 |
All known versions for source package 'node-tar'
- 7.5.19+~4.0.1-2 (sid)
- 6.2.1+ds1+~cs6.1.13-10 (forky)
- 6.2.1+~cs7.0.8-1+deb13u1 (trixie)
- 6.1.13+~cs7.0.5-1+deb12u1 (bookworm-security)
- 6.1.13+~cs7.0.5-1 (bookworm)