node-tar EUVD-2026-42305

Exploitation requires that the target application uses node-tar (prior to 7.5.19) to extract or parse an archive whose bytes the attacker can influence - i.e., the app must ingest untrusted, externally-supplied gzip tar input through the extract or parse paths in src/extract.ts. The limiting factor is exposure, not privilege: per the CVSS vector this is remote and unauthenticated (PR:N, UI:N, AC:L) with no special product configuration flag needed, so default extraction behavior is affected. Realistic risk is bounded to deployments that actually accept attacker-controlled archives (upload handlers, CI/build systems, package tooling); applications that only extract locally-generated, trusted tarballs are not meaningfully exposed despite running the vulnerable version.

Signals are consistent and point to a genuine availability risk rather than an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, unauthenticated, low-complexity abuse with high availability impact on both the vulnerable component (VA:H) and subsequent systems (SA:H, reflecting host-level disk exhaustion), yielding 9.2 Critical. Impact is strictly availability - confidentiality and integrity are untouched (VC:N/VI:N) - so the 9.2 is driven entirely by DoS severity, which is appropriate but should be read as 'service/host outage,' not compromise. No EPSS score, KEV entry, or POC was provided: this is not confirmed to be actively exploited, and no public exploit code was identified at time of analysis. The practical severity hinges on exposure - an app that only extracts trusted, self-generated tarballs faces little real risk, whereas any service that ingests user-uploaded or third-party archives (CI systems, package tooling, upload processors) is directly exploitable. The high CVSS is justified for exposed deployments but contextual for internal-only usage.

An attacker uploads a few-kilobyte crafted gzip-compressed tar file to any service that automatically extracts it with a vulnerable node-tar - for example a CI pipeline, package registry mirror, or file-upload endpoint. During extraction the archive inflates to gigabytes, filling the disk and pinning CPU, which crashes the service or the host. No authentication or user interaction is required, and no public exploit code has been identified, though the gzip-bomb technique is well known and trivial to reproduce.