VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 21, 2024· Updated Feb 13, 2025

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

CVE-2024-28863

Description

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
node-tarnpm
< 6.2.16.2.1
tarnpm
< 6.2.16.2.1

Affected products

69

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.