CVE-2026-59873: Decompression DoS Via Unlimited Input In node-tar, 90M Weekly Downloads Affected
Patchnode-tarOur summary
A critical vulnerability in the widely used JavaScript library node-tar has been patched, addressing a denial-of-service flaw that could allow attackers to exhaust server storage and crash services. The issue, tracked as CVE-2026-59873, affects versions up to 7.5.18 and enables resource exhaustion through specially crafted gzip-compressed tar files. Attackers can exploit this by sending malicious archives that expand exponentially during decompression, leading to high CPU usage and full disk consumption. The fix in version 7.5.19 introduces limits on decompression ratios to prevent such attacks.
Below is the opening; the full story is at OX Security.
From OX Security
A new CVE dropped in node-tar, allowing a crafted gzip’d tar files to fill servers storage and crash services where user controlled tar files are processed by node-tar
Overview
A decompression vulnerability was found in node-tar, allowing a single crafted ZIP Bomb gzipped tar file to crash services using node-tar.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.