CVE-2024-28863 node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation
An attacker can cause a denial of service by providing a tar file with excessively deep sub-folders, consuming memory and crashing the Node.js client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-28863?
CVE-2024-28863 is a medium-severity denial of service vulnerability in isaacs node-tar, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
Which versions are affected by CVE-2024-28863?
4 open source packages ship an affected version, including node-tar and tar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node-tar npm | All versions | 6.2.1 |
node-tar npm | All versions | 6.2.1 |
tar npm | All versions | 6.2.1 |
tar npm | All versions | 6.2.1 |
Products include Isaacs Tar.
How do I fix CVE-2024-28863?
Upgrade node-tar to 6.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-28863 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28863 exists.
Other vulnerabilities in isaacs node-tar
- CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
- CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
- CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
- CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath
- CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
Sources
Also known as AZL-37115, AZL-37121, AZL-37136, CLSA-2025-1756305640, CLSA-2026-1770717358, CLSA-2026-1775176090 and 7 more.