Patch released node-tar web-app ddos-botnet
CVE-2026-59873: Decompression DoS Via Unlimited Input In node-tar, 90M Weekly Downloads Affected
CVE Tools coverage
A critical vulnerability in the widely used JavaScript library node-tar has been patched, addressing a denial-of-service flaw that could allow attackers to exhaust server storage and crash services. The issue, tracked as CVE-2026-59873, affects versions up to 7.5.18 and enables resource exhaustion through specially crafted gzip-compressed tar files. Attackers can exploit this by sending malicious archives that expand exponentially during decompression, leading to high CPU usage and full disk consumption. The fix in version 7.5.19 introduces limits on decompression ratios to prevent such attacks.
A new CVE dropped in node-tar, allowing a crafted gzip’d tar files to fill servers storage and crash services where user controlled tar files are processed by node-tar
Overview
A decompression vulnerability was found in node-tar, allowing a single crafted ZIP Bomb gzipped tar file to crash services using node-tar.…