CVE-2026-59873CWE-770

node-tar: Decompression/parse DoS via unlimited input

Critical · published July 8, 2026

CVSS v4.0

9.2

EPSS

Percentile

47.1

In the wild

Unconfirmed

What it is

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.

The record

Technical detail

CVSS v4.0: 9.2 · CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
EPSS: 0.00582 · 47.1th percentile
Weakness: CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2026-07-08T15:22Z

EPSS history

Timeline

08 JUL 15:22Z
node-tar: Decompression/parse DoS via unlimited input
cvelistv5