CVE-2026-59873: node-tar DoS Vulnerability

CVE-2026-59873 Overview

CVE-2026-59873 is a resource exhaustion vulnerability in node-tar, a widely used tar archive manipulation library for Node.js. Versions prior to 7.5.19 fail to enforce upper bounds on total decompressed data, entry counts, or decompression ratios during extraction and parsing. Attackers can supply a small crafted gzip bomb that exhausts disk space and CPU on the host processing the archive. The flaw is tracked as [CWE-770] (Allocation of Resources Without Limits or Throttling) and is fixed in node-tar version 7.5.19.

Critical Impact
A network-reachable attacker can trigger denial of service against any Node.js application that parses untrusted tar archives, exhausting storage and processing capacity without authentication.

Affected Products

node-tar versions prior to 7.5.19
Node.js applications that consume untrusted tar or gzipped tar archives via node-tar
Downstream tooling and package managers that depend on vulnerable node-tar releases

Discovery Timeline

2026-07-08 - CVE-2026-59873 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59873

Vulnerability Analysis

The vulnerability resides in the extraction and parsing paths of node-tar, specifically src/extract.ts and related parsing logic. Prior to version 7.5.19, the library streams decompressed gzip, brotli, and zstd data without tracking the ratio of decompressed bytes to compressed bytes. It also does not cap total entry counts or aggregate decompressed size. An attacker who can deliver a tar archive to a processing pipeline can craft a compact archive that expands to gigabytes or terabytes of data. This asymmetric expansion drives disk consumption to full and forces sustained CPU utilization on the decompression thread.

Root Cause

The root cause is missing enforcement of resource limits during streaming decompression. The library trusted the compressed input to expand within reasonable bounds. No counters compared compressedBytesRead against decompressedBytesRead, so classic zip-bomb style inputs proceeded to full expansion. The fix introduces symbols such as COMPRESSEDBYTESREAD, DECOMPRESSEDBYTESREAD, and a CHECKDECOMPRESSIONRATIO guard, plus a new maxDecompressionRatio option defaulting to 1000.

Attack Vector

Exploitation requires only that a vulnerable application accept and process an attacker-controlled tar archive. Common vectors include upload endpoints, package installation flows, CI/CD build steps that unpack fetched artifacts, and services that expand backups or container image layers. No authentication or user interaction is required in most deployments.

typescript

// Security patch in src/options.ts — introduces maxDecompressionRatio guard
   */
  onwarn?: (code: string, message: string, data: WarnData) => unknown

+  /**
+   * The maximum allowed ratio of decompressed bytes to compressed bytes when
+   * reading gzip, brotli, or zstd-compressed archives.
+   *
+   * This defaults to `1000` and aborts extraction or parsing when exceeded.
+   * Set to `Infinity` to disable the limit.
+   */
+  maxDecompressionRatio?: number
+
  //////////////////////////
  // extraction options

Source: node-tar commit 2812e93

typescript

// Security patch in src/parse.ts — tracks compressed vs decompressed bytes
const SAW_NULL_BLOCK = Symbol('sawNullBlock')
const SAW_EOF = Symbol('sawEOF')
const CLOSESTREAM = Symbol('closeStream')
+const MAX_DECOMPRESSION_RATIO = 1000
+const COMPRESSEDBYTESREAD = Symbol('compressedBytesRead')
+const DECOMPRESSEDBYTESREAD = Symbol('decompressedBytesRead')
+const CHECKDECOMPRESSIONRATIO = Symbol('checkDecompressionRatio')

const noop = () => true

Source: node-tar commit 2812e93

Detection Methods for CVE-2026-59873

Indicators of Compromise

Sudden growth of temporary or extraction directories to fill available disk space during archive processing
Node.js processes sustaining 100% CPU on a single core while streaming a small input file
Application logs showing extraction operations that never complete or terminate with disk-full errors
Repeated upload attempts of small .tar.gz, .tar.br, or .tar.zst files followed by service degradation

Detection Strategies

Inventory Node.js applications and CI/CD workers for node-tar versions below 7.5.19 using software composition analysis
Instrument tar processing code paths to log compressed input size and resulting decompressed size for anomaly review
Alert on host-level disk utilization spikes correlated to child processes invoking tar extraction
Review web application logs for archive upload endpoints receiving unusually small files followed by resource pressure

Monitoring Recommendations

Set thresholds for disk free space and per-process CPU time on servers that ingest user-supplied archives
Monitor Node.js event loop lag and worker thread saturation on archive processing services
Track dependency drift in build pipelines to catch reintroduction of vulnerable node-tar versions
Correlate filesystem write bursts with process ancestry to identify runaway decompression

How to Mitigate CVE-2026-59873

Immediate Actions Required

Upgrade node-tar to version 7.5.19 or later across all direct and transitive dependencies
Run npm ls tar or equivalent to locate nested vulnerable copies and force resolutions where needed
Restrict archive ingestion endpoints to authenticated users until patched, where feasible
Apply request-level size limits and rate limits on any endpoint that accepts tar archives

Patch Information

The fix ships in node-tar 7.5.19. See the GitHub Release v7.5.19 and the GitHub Security Advisory GHSA-23hp-3jrh-7fpw for details. The patch introduces a maxDecompressionRatio option defaulting to 1000 and adds runtime guards that abort extraction when the ratio is exceeded.

Workarounds

Enforce upstream size limits on uploaded archives before passing them to node-tar
Run extraction inside a resource-constrained sandbox with disk quotas and CPU cgroups
Reject archives from untrusted sources until the library is upgraded
After upgrading, tune maxDecompressionRatio downward for stricter environments processing predictable inputs

bash

# Upgrade node-tar to the patched release
npm install tar@^7.5.19

# Verify no vulnerable versions remain in the dependency tree
npm ls tar

# Optional: enforce a stricter decompression ratio at call site
# tar.extract({ file: 'input.tgz', maxDecompressionRatio: 100 })