CVE-2024-28863

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

Published Mar 21, 2024 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4552-1 node-tar security update
Debian DLA Debian DLA DLA-4712-1 node-tar security update
EUVD EUVD EUVD-2024-0909 node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
Github GHSA Github GHSA GHSA-f5x3-32g6-xq36 Denial of service while parsing a tar file due to lack of folders count validation
History
Type Values Removed Values Added
First Time appeared Isaacs
Isaacs tar
CPEs cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*
Vendors & Products Isaacs
Isaacs tar
Type Values Removed Values Added
First Time appeared Node-tar Project
Node-tar Project node-tar
CPEs cpe:2.3:a:node-tar_project:node-tar:*:*:*:*:*:*:*:*
Vendors & Products Node-tar Project
Node-tar Project node-tar
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat satellite
CPEs cpe:/a:redhat:satellite_maintenance:6.16::el8
cpe:/a:redhat:satellite_maintenance:6.16::el9
cpe:/a:redhat:satellite:6.16::el8
Vendors & Products Redhat satellite Maintenance
Redhat satellite
Type Values Removed Values Added
First Time appeared Redhat satellite Maintenance
CPEs cpe:/a:redhat:satellite_maintenance:6.16::el8
cpe:/a:redhat:satellite_maintenance:6.16::el9
Vendors & Products Redhat satellite Maintenance
Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8
Vendors & Products Redhat enterprise Linux
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Feb 13, 2025, 5:47 PM
Reserved
Mar 11, 2024, 10:45 PM
Status
Analyzed
Published
Mar 21, 2024, 11:15 PM
Modified
Jun 17, 2026, 7:21 AM
Severity
Moderate
Public date
Mar 21, 2024, 12:00 AM