node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
CVSS Details
- CVSS 4.0 Base Score: 9.2 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade npm | Jul 30, 2026 | Jul 28, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-libsUpgrade v8-13.6-develUpgrade nodejs24-npmUpgrade nodejs22-libsUpgrade nodejs22-debugsourceUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs22Upgrade nodejs22-develUpgrade nodejs24-docsUpgrade nodejs22-docsUpgrade nodejs24-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs22-npmUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade v8-12.4-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-libs-debuginfo | Aug 18, 2026 | Jul 8, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Aug 19, 2026 | Aug 18, 2026 |
| Redhat_linux | — | Upgrade v8-12.4-develUpgrade nodejs22-debuginfoUpgrade nodejs-nodemonUpgrade nodejs24-debuginfoUpgrade npmUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs-docsUpgrade nodejs24-docsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs-develUpgrade nodejs24-npmUpgrade rh-podman-desktopUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs24No solution exists | Jul 17, 2026 | Jul 8, 2026 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs24-debuginfoUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade npmUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs24Upgrade nodejs24-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs-libsUpgrade nodejs | Jul 31, 2026 | Jul 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub