node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.

This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library's archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-pccs Cryostat 4 Not affected cryostat-openshift-console-plugin-npm Cryostat 4 Not affected grafana-infinity-datasource-npm Cryostat 4 Not affected tar Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Node HealthCheck Operator Affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Affected workload-availability/node-healthcheck-rhel9-operator OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-rhel9 Red Hat 3scale API Management Platform 2 Affected 3scale-amp21/system Red Hat 3scale API Management Platform 2 Affected 3scale-amp22/system Red Hat 3scale API Management Platform 2 Affected 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Affected 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Affected 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-rhel9 Red Hat AMQ Broker 7 Affected tar Red Hat build of Apache Camel for Spring Boot 4 Not affected tar Red Hat build of Apache Camel - HawtIO 4 Affected tar Red Hat Build of Podman Desktop Affected rh-podman-desktop.git Red Hat Connectivity Link 1 Affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Affected linux-sgx Red Hat Enterprise Linux 10 Affected nodejs22 Red Hat Enterprise Linux 10 Affected nodejs24 Red Hat Enterprise Linux 10 Affected tar Red Hat Enterprise Linux 6 Affected tar Red Hat Enterprise Linux 7 Affected tar Red Hat Enterprise Linux 8 Not affected dotnet5.0-build-reference-packages Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Not affected grafana-pcp Red Hat Enterprise Linux 8 Affected mozjs60 Red Hat Enterprise Linux 8 Affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Affected gjs Red Hat Enterprise Linux 9 Affected linux-sgx Red Hat Enterprise Linux 9 Affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Affected tar Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Affected aardvark-dns Red Hat Hardened Images Affected chunkah Red Hat Hardened Images Affected netavark Red Hat Hardened Images Affected python-cryptography Red Hat Hardened Images Affected rust Red Hat Hardened Images Affected rust-rpm-sequoia Red Hat Hardened Images Affected tar Red Hat Hardened Images Affected yarnpkg Red Hat JBoss Enterprise Application Platform 7 Not affected tar Red Hat JBoss Enterprise Application Platform Expansion Pack Affected tar Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Affected rhcos Red Hat Openshift Data Foundation 4 Affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/udi-rhel9 Red Hat Satellite 6 Affected satellite/iop-remediations-rhel9 Red Hat Single Sign-On 7 Affected tar Red Hat Trusted Artifact Signer Affected rhtas/rekor-search-ui-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59873 https://nvd.nist.gov/vuln/detail/CVE-2026-59873 https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3 https://github.com/isaacs/node-tar/releases/tag/v7.5.19 https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw