node-tar Fixes Memory Consumption and Crashing Issue in Deep Sub-Folders
CVE-2024-28863

6.5MEDIUM

Key Information:

Vendor

Isaacs

Status
Node-tar
Vendor
CVE Published:
21 March 2024

What is CVE-2024-28863?

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Affected Version(s)

node-tar < 6.2.1

References

https://github.com/isaacs/node-tar/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8...
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20240524-0005/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.