VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 21, 2024· Updated Jun 17, 2026

CVE-2024-28863

CVE-2024-28863

Description

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
node-tarnpm
< 6.2.16.2.1
tarnpm
< 6.2.16.2.1

Affected products

82

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.