CyberRota Analysis
AI-GeneratedThe node-tar library for Node.js is vulnerable to denial-of-service attacks due to its inability to enforce limits on decompressed data, entry counts, or decompression ratios, which can be exploited by a crafted gzip bomb. This can lead to excessive disk space and CPU consumption, potentially disrupting services that rely on this library. Developers and organizations using node-tar versions prior to 7.5.19 should prioritize upgrading to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
Related CVEs
Other vulnerabilities affecting the same vendor(s)