Skip to main content

node-tar CVE-2026-59873

| EUVDEUVD-2026-42305 CRITICAL
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-08 GitHub_M GHSA-23hp-3jrh-7fpw
Denial Of Service Node.js Red Hat Suse Node Tar Isaacs
9.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Remote unauthenticated processing of a crafted archive (AV:N/AC:L/PR:N/UI:N) causes availability-only impact via resource exhaustion (A:H), with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 08, 2026 - 17:01 EUVD
Analysis Generated
Jul 08, 2026 - 16:22 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 108 npm packages depend on tar (52 direct, 56 indirect)

Ecosystem-wide dependent count for version 7.5.19.

DescriptionCVE.org

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.

Articles & Coverage 2

News 5 New Node.js Vulnerabilities - 1 Critical, 4 High Severity Jul 09, 2026 News Critical DoS via Gzip Bomb in Node.js node-tar before 7.5.19 - CVE-2026-59873 Jul 08, 2026

AnalysisAI

Uncontrolled resource consumption in node-tar before 7.5.19 lets a small crafted gzip bomb exhaust disk space and CPU on any Node.js application that extracts or parses attacker-supplied tar archives. Because node-tar imposes no upper bound on total decompressed size, entry count, or compression ratio in its extract and parse paths, a tiny malicious file can inflate to consume all available storage and processing, causing denial of service. No public exploit has been identified, but the fix is a straightforward, well-documented behavior change published in the vendor advisory GHSA-23hp-3jrh-7fpw.

Technical ContextAI

node-tar (npm package 'tar', maintained by isaacs) is the de-facto tar archive library for the Node.js ecosystem and is itself a dependency of npm. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the streaming extraction/parsing logic in src/extract.ts feeds gzip-compressed input through decompression and writes entries to disk without enforcing a ceiling on cumulative decompressed bytes, number of entries, or the decompression ratio. Gzip and similar DEFLATE-based formats routinely achieve ratios of 1000:1 or higher on highly repetitive data, so a few kilobytes of crafted input can expand to gigabytes - the classic 'zip/gzip bomb' amplification - with no guardrail to abort once a sane threshold is crossed. The single CPE (cpe:2.3:a:isaacs:node-tar) confirms the library itself is the affected component regardless of the consuming application.

RemediationAI

Vendor-released patch: upgrade node-tar to version 7.5.19 or later, which introduces enforced upper bounds on total decompressed data, entry counts, and decompression ratio (fixing commit 2812e9338665659b183aa7226518c307044957d3; release https://github.com/isaacs/node-tar/releases/tag/v7.5.19; advisory https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw). Because node-tar is frequently a transitive dependency, audit your dependency tree (for example with npm ls tar or npm audit) and force-resolve nested copies to 7.5.19. Until you can upgrade, apply compensating controls at the application layer: reject or cap the size of incoming archives before handing them to node-tar (enforce a maximum compressed input size and a maximum expected extracted size), extract into a size-quota'd or dedicated filesystem/volume so an inflation attack cannot fill the primary disk, and impose CPU/time limits on extraction workers (side effect: legitimately large archives may be rejected, so tune thresholds to your real workloads). Where feasible, only process archives from trusted sources.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected

Share

CVE-2026-59873 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy