CVE-2026-59873: node-tar Gzip Bomb Denial of Service (HIGH)

Technical summary

CVE-2026-59873 exploits missing resource constraints in node-tar's extraction and parsing logic, specifically in src/extract.ts. The vulnerability stems from the absence of enforced upper bounds on three critical parameters: total decompressed output size, the number of entries (files/directories) in the archive, and the compression ratio (ratio of decompressed to compressed size). An attacker can construct a gzip-compressed tar archive that is small on disk but decompresses to gigabytes or terabytes of data, or contains an extremely high number of directory entries. When node-tar processes such an archive without bounds-checking, the decompression operation exhausts available system resources. This is a classic zip bomb / gzip bomb scenario applied to tar archives. The vulnerability affects all versions prior to 7.5.19, which introduces proper resource limiting.

Business impact

Organizations running applications that extract untrusted tar archives—particularly those exposed to user uploads, API inputs, or network traffic—face denial-of-service risk. A compromised or malicious supply chain dependency, or direct exploitation via a crafted archive, can render affected services unavailable by exhausting disk space or CPU. For platforms providing file upload or archive extraction services, this creates both availability and potentially storage-cost impacts. The attack requires no privileges and no user interaction beyond processing a file, making it a straightforward vector for disruption.

Affected systems

Any application or service using isaacs/node-tar versions prior to 7.5.19 is affected. This includes direct users of the library as well as downstream dependencies. Given node-tar's popularity in the Node.js ecosystem, impact is potentially widespread across web applications, build tools, deployment pipelines, and microservices that handle tar archives. Verify your supply chain and dependency trees for all instances of node-tar, including transitive dependencies.

Exploitability

Exploitability is straightforward: an attacker needs only to craft a gzip bomb tar file and cause it to be extracted by vulnerable code. No authentication, user interaction, or complex setup is required. The attack vector is network-based, and the CVSS score of 7.5 (HIGH) reflects the ease of exploitation and availability impact. However, exploitation requires the application to actually process the malicious archive—applications that reject oversized or suspicious archives before processing may be partially protected. No active exploitation has been reported in the wild at this time (KEV status is false).

Remediation

Upgrade node-tar to version 7.5.19 or later. This release introduces enforced resource limits during extraction and parsing. Organizations should inventory all dependencies on node-tar—both direct and transitive—and plan upgrades across affected applications and services. Test upgraded versions in non-production environments to ensure compatibility before deploying to production. Additionally, consider implementing application-level safeguards such as file size limits, decompression ratio checks, or sandboxed extraction processes for untrusted archives.

Patch guidance

Update node-tar to 7.5.19 or any subsequent patch release. If you use npm or yarn, run `npm update node-tar` or `yarn upgrade node-tar` respectively, then commit the updated lock file. Verify in package.json or package-lock.json that node-tar is pinned to >= 7.5.19. For applications with pinned versions, manually update the version constraint. Test extraction of both trusted archives and intentionally crafted test cases to confirm the fix mitigates resource exhaustion. Refer to the official isaacs/node-tar repository and release notes for detailed version information and any known issues with specific upgrade paths.

Detection guidance

Monitor for extraction operations that consume unexpectedly high CPU or disk I/O for extended periods, or that cause rapid disk space depletion. Log and alert on archive extraction operations that involve small input files but large decompressed outputs or high entry counts. Implement rate limiting and resource quotas for extraction processes. Network-level detection is limited but may include monitoring for unusually large file uploads followed by service degradation. Behavioral indicators include sustained high CPU load during file processing, sudden disk space exhaustion, or service timeouts during archive extraction. Consider enabling verbose logging in node-tar extraction paths to track archive metadata (file count, sizes) before full decompression.

Why prioritize this

This vulnerability warrants prompt remediation due to its high CVSS score (7.5), ease of exploitation, and potential for widespread impact across the Node.js ecosystem. The attack requires no privilege escalation, authentication, or user interaction—only network access and a crafted file. While KEV status is false, the vulnerability is straightforward to exploit once identified. Organizations should prioritize patching after assessing the extent of node-tar usage in their environment and dependencies.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Attack Vector = Network (AV:N, remotely exploitable), Attack Complexity = Low (AC:L, no special conditions needed), Privileges Required = None (PR:N, no authentication), User Interaction = None (UI:N, automatic upon processing), Scope = Unchanged (S:U), and Availability Impact = High (A:H, denial of service). The absence of confidentiality or integrity impact (C:N, I:N) keeps the score from reaching critical, but the guaranteed availability denial and trivial exploit path justify the HIGH severity.

Frequently asked questions