StackRadarChart IndexLive demo

CVE-2025-64118

Medium

Advisory

Published 30 Oct 2025In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.001; 3rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 22; of 17,781 indexed, latest versions
Container images: 19; deployed by those charts
Fix available: 1 of 2; affected packages

node-tar has a race condition leading to uninitialized memory exposure

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 19 images.

Affected package	Affected versions	Fixed in	Images
tarnpm	7.5.1	7.5.2	13
node-tardeb	1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3	no fix listed	6

OSV records: GHSA-29xp-372q-xqph UBUNTU-CVE-2025-64118

Charts affected

22 by stars

Chart

Latest

Affected images

Radar Score

immichimmich-helm

1 of 4 See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	tar@7.5.1	7.5.2

Open the chart page →

15,712

kube-ingress-dash-chartkube-ingress-dash

1 of 1 See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	tar@7.5.1	7.5.2

Open the chart page →

1,505

prowlerprowler-app

1 of 5 See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
prowlercloud/prowler-ui :5.31.1	79ee83c8e702	tar@7.5.1	7.5.2

Open the chart page →

8,158

bluerange-mosquittobluerange

1 of 1 See more

bluerange-mosquitto bluerange 1.0.4

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
bluerange/bluerange-mosquitto :25	f1bfbba84832	tar@7.5.1	7.5.2

Open the chart page →

1,168

otbrcharts-derwitt-dev

1 of 1 See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
openthread/otbr :latest	f307f59f6432	node-tar@2.2.1-1	no fix listed

Open the chart page →

12,779

ethereumcloudnativeapp

1 of 3 See more

ethereum cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
ethereumex/eth-stats-dashboard :v0.0.1	a7603aa8df4c	node-tar@1.0.3-2	no fix listed

Open the chart page →

27,417

codehubcodehub

1 of 5 See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
jupyterhub/jupyterhub :5.4.6	3974ba945e65	node-tar@6.1.13+~cs7.0.5-3	no fix listed

Open the chart page →

13,220

devtron-enterprisedevtron

1 of 28 See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	tar@7.5.1	7.5.2

Open the chart page →

68,240

devtron-enterprisedevtron-labs

1 of 28 See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	tar@7.5.1	7.5.2

Open the chart page →

68,240

ilum-marquezilum

1 of 3 See more

ilum-marquez ilum 6.7.0

1 of the 3 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
ilum/marquez-web :0.53.2	716437a51a6c	tar@7.5.1	7.5.2

Open the chart page →

6,254

github-exporterjkroepke

1 of 1 See more

github-exporter jkroepke 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
jkroepke/github_exporter :1.8.0	3d850992786d	tar@7.5.1	7.5.2

Open the chart page →

1,031

k8s-jacoco-operatork8s-jacoco-operator

1 of 4 See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

1 of the 4 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
ghcr.io/curium-rocks/k8s-jacoco-operator :main	a558ceae6cdb	tar@7.5.1	7.5.2

Open the chart page →

2,437

pangolinkrzwiatrzyk

1 of 1 See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
fosrl/pangolin :1.13.0	c32ad797ab96	tar@7.5.1	7.5.2

Open the chart page →

3,441

nublado2lsst-sqre

1 of 2 See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	node-tar@4.4.10+ds1-2ubuntu1	no fix listed

Open the chart page →

17,779

bofmojaloop

1 of 1 See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	tar@7.5.1	7.5.2

Open the chart page →

2,457

security-role-perm-operator-svcmojaloop

1 of 1 See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	tar@7.5.1	7.5.2

Open the chart page →

2,457

openwhiskopenwhisk

1 of 10 See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
openwhisk/ow-utils :1.0.0	c80dba0de3aa	node-tar@2.2.1-1	no fix listed

Open the chart page →

36,215

readability-js-serverreadability-js-server

1 of 1 See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
phpdockerio/readability-js-server :1.8.0	ea8354b42600	tar@7.5.1	7.5.2

Open the chart page →

1,858

devtron-enterpriseromholdings

1 of 28 See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	tar@7.5.1	7.5.2

Open the chart page →

68,240

counter-dhlsikademo

1 of 3 See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
ghcr.io/ondrejsika/counter-frontend :latest	c4166d2eb8eb	tar@7.5.1	7.5.2

Open the chart page →

4,820

grafanasvtech-public-helm-charts

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	node-tar@4.4.10+ds1-2ubuntu1	no fix listed

Open the chart page →

10,902

tensorzerotensorzero

1 of 2 See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2025-64118.

Container image	Digest	Package	Fixed in
tensorzero/ui :2026.6.0	f2563d54724e	tar@7.5.1	7.5.2

Open the chart page →

3,972

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	tar@7.5.1	7.5.2	3
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	tar@7.5.1	7.5.2	2
bluerange/bluerange-mosquitto :25	f1bfbba84832	tar@7.5.1	7.5.2	1
ethereumex/eth-stats-dashboard :v0.0.1	a7603aa8df4c	node-tar@1.0.3-2	no fix listed	1
fosrl/pangolin :1.13.0	c32ad797ab96	tar@7.5.1	7.5.2	1
ilum/marquez-web :0.53.2	716437a51a6c	tar@7.5.1	7.5.2	1
jkroepke/github_exporter :1.8.0	3d850992786d	tar@7.5.1	7.5.2	1
jupyterhub/jupyterhub :5.4.6	3974ba945e65	node-tar@6.1.13+~cs7.0.5-3	no fix listed	1
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	node-tar@4.4.10+ds1-2ubuntu1	no fix listed	1
openthread/otbr :latest	f307f59f6432	node-tar@2.2.1-1	no fix listed	1
openwhisk/ow-utils :1.0.0	c80dba0de3aa	node-tar@2.2.1-1	no fix listed	1
phpdockerio/readability-js-server :1.8.0	ea8354b42600	tar@7.5.1	7.5.2	1
prowlercloud/prowler-ui :5.31.1	79ee83c8e702	tar@7.5.1	7.5.2	1
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	node-tar@4.4.10+ds1-2ubuntu1	no fix listed	1
tensorzero/ui :2026.6.0	f2563d54724e	tar@7.5.1	7.5.2	1
ghcr.io/curium-rocks/k8s-jacoco-operator :main	a558ceae6cdb	tar@7.5.1	7.5.2	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	tar@7.5.1	7.5.2	1
ghcr.io/ondrejsika/counter-frontend :latest	c4166d2eb8eb	tar@7.5.1	7.5.2	1
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	tar@7.5.1	7.5.2	1