CVE-2024-28863: node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation
Vulnerability summary
CVE-2024-28863 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in isaacs node-tar. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.6% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 7Timeline
- 21-03-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.93% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNode Tar
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard41 products
- jupyter-base-notebook< 7.6.3-r2
- lerna< 8.1.3-r0
- npm< 10.5.1-r0
- opensearch-dashboards-2< 2.15.0-r0
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.15.0-r0
Wolfi9 products
- jupyter-base-notebook< 7.6.3-r2
- lerna< 8.1.3-r0
- npm< 10.5.1-r0
- pnpm-stage0< 8.7.4-r6
- py3.10-jupyterlab< 4.6.1-r1
Npm2 products
- node-tar< 6.2.1
- tar< 6.2.1
Debian1 product
- node-tar< 6.1.13+~cs7.0.5-1+deb12u1 | < 6.1.13+~cs7.0.5-2
Ubuntu1 product
- node-tarAll versions (No fix recorded)
6 vendors · 56 products
References
10 links- github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36X Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7X Refsource MISCREPORTFIXWEBPatch
- github.com/isaacs/node-tarPACKAGE