Node.js Library Vulnerability in node-tar Affecting Multiple Versions

CVE-2026-59873

What is CVE-2026-59873?

CVE-2026-59873 is a vulnerability identified in the node-tar library, which is a popular tool used for manipulating tar archives within Node.js applications. This library facilitates the extraction and parsing of tar files, integral for applications that handle file packaging and transfers. The vulnerability arises from a lack of stringent limits on total decompressed data, entry counts, and the decompression ratio. As a result, attackers can exploit the library to deploy specially crafted gzip bombs that could overwhelm system resources, ultimately leading to severe performance degradation or even complete service disruption. The issue is rectified in version 7.5.19 of the node-tar library.

Potential Impact of CVE-2026-59873

1. Resource Exhaustion: By triggering the vulnerability, an attacker can create scenarios where the affected system runs out of disk space or CPU, causing applications to crash or become unresponsive, impacting availability and resulting in possible downtime.

2. Denial of Service (DoS): Maliciously crafted inputs can exhaust system resources, effectively leading to a denial of service. This undermines the reliability of applications dependent on the node-tar library, which are commonplace in various web services and enterprise solutions.

3. Operational costs: The consequences of such resource exhaustion may require organizations to invest additional resources in recovery efforts, including potential infrastructure upgrades or downtime compensation, which can significantly impact operational budgets and overall efficiency.

References