CVE-2024-28863CWE-400CWE-770

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

Medium · published March 21, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00929 · 60.2th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-03-21T22:10Z
EPSS history
Timeline
  • 21 MAR 22:10Z
    node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation
    cvelistv5