Skip to content
fr Sign in
6.5 Medium

CVE-2024-28863 node-tar is a Tar for Node.js

Description

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Affected products and versions

Product Affected versions Fixed in
node-tar 6.2 earliest → < 6.2.1 6.2.1
node-tar 6.2 earliest → < 6.2.1 6.2.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of node-tar

The 14 CVEs of node-tar →
CVE-2026-73566 node-tar is a tar archive manipulation library for Node.js 7.5 High CVE-2026-59871 node-tar is a tar archive manipulation library for Node.js 5.3 Medium CVE-2026-59874 node-tar is a tar archive manipulation library for Node.js 8.7 High CVE-2026-59873 node-tar is a tar archive manipulation library for Node.js 9.2 Critical
Track this CVE