CyberRota Analysis
AI-GeneratedThe node-tar library for Node.js is vulnerable to an issue where the tar.replace function can accept a checksum-valid tar header with a negative base-256 encoded entry size, leading to denial of service as the archive scanner gets stuck in an infinite loop. This vulnerability impacts applications relying on affected versions prior to 7.5.18, and organizations using node-tar should prioritize upgrading to version 7.5.18 or later to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Related CVEs
Other vulnerabilities affecting the same vendor(s)