CVE-2026-59873 Details
Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
A denial-of-service vulnerability has been identified in the node-tar library, which is used for manipulating tar archives in Node.js. This vulnerability exists in versions of node-tar through 7.5.18. The issue arises because the library does not impose strict limits on the total amount of decompressed data, the number of entries, or the decompression ratio during extraction and parsing. As a result, a small, crafted gzip bomb can be used to quickly consume disk space and CPU resources. The vulnerability is particularly concerning in applications that handle tar archives from untrusted sources, such as npm registries or file-sharing platforms.
Users can upgrade to node-tar version 7.5.19 or later, where this vulnerability has been fixed. The updated version includes a maximum decompression ratio option that can be set to prevent explosive decompression.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3 | [email protected] | Patch |
| https://github.com/isaacs/node-tar/releases/tag/v7.5.19 | [email protected] | Release Notes |
| https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| isaacs tar | < 7.5.19 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |