Description
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
Published: 2024-03-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4552-1 node-tar security update
EUVD EUVD EUVD-2024-0909 node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
Github GHSA Github GHSA GHSA-f5x3-32g6-xq36 Denial of service while parsing a tar file due to lack of folders count validation
History

Tue, 16 Dec 2025 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Isaacs
Isaacs tar
CPEs cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*
Vendors & Products Isaacs
Isaacs tar

Fri, 14 Feb 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Node-tar Project
Node-tar Project node-tar
CPEs cpe:2.3:a:node-tar_project:node-tar:*:*:*:*:*:*:*:*
Vendors & Products Node-tar Project
Node-tar Project node-tar
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 07 Nov 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat satellite
CPEs cpe:/a:redhat:satellite_maintenance:6.16::el8
cpe:/a:redhat:satellite_maintenance:6.16::el9
cpe:/a:redhat:satellite:6.16::el8
Vendors & Products Redhat satellite Maintenance
Redhat satellite

Wed, 06 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat satellite Maintenance
CPEs cpe:/a:redhat:satellite_maintenance:6.16::el8
cpe:/a:redhat:satellite_maintenance:6.16::el9
Vendors & Products Redhat satellite Maintenance

Thu, 26 Sep 2024 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt

Fri, 06 Sep 2024 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9

Mon, 26 Aug 2024 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8
Vendors & Products Redhat enterprise Linux

Subscriptions

Isaacs Tar
Node-tar Project Node-tar
Redhat Enterprise Linux Openshift Data Foundation Rhmt Satellite
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-02-13T17:47:34.618Z

Reserved: 2024-03-11T22:45:07.686Z

Link: CVE-2024-28863

cve-icon Vulnrichment

Updated: 2024-08-02T00:56:58.545Z

cve-icon NVD

Status : Analyzed

Published: 2024-03-21T23:15:10.910

Modified: 2025-12-16T17:25:07.493

Link: CVE-2024-28863

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-03-21T00:00:00Z

Links: CVE-2024-28863 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses