CVE-2024-28863: Denial of service while parsing a tar file due to lack of folders count validation

March 22, 2024

Denial of service by crashing the nodejs client when attempting to parse a tar archive, make it run out of heap memory and consuming server CPU and memory resources

References

github.com/advisories/GHSA-f5x3-32g6-xq36
github.com/isaacs/node-tar
github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
nvd.nist.gov/vuln/detail/CVE-2024-28863

Code Behaviors & Features

Detect and mitigate CVE-2024-28863 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →