PT-2026-56493
CVE-2026-59873
·
Published
2026-06-28
·
Updated
2026-10-15
Description by
CVSS 4.0
9.2
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Name of the Vulnerable Software and Affected Versions
node-tar versions prior to 7.5.19
Description
Insufficient enforcement of hard upper bounds on total decompressed data, entry counts, or decompression ratio within extraction and parsing paths, such as
src/extract.ts, allows a crafted gzip bomb to exhaust CPU and disk space. A gzip bomb is a highly compressed archive that expands to an enormous size when decompressed, leading to a denial of service.Recommendations
Update to version 7.5.19.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾