CVE-2026-59873: node-tar: Decompression/parse DoS via unlimited input

July 20, 2026

A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources (disk space and CPU). Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted “Gzip Bomb” can be used to fill a server’s storage and crash services.

References

github.com/advisories/GHSA-23hp-3jrh-7fpw
github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3
github.com/isaacs/node-tar/releases/tag/v7.5.19
github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw
nvd.nist.gov/vuln/detail/CVE-2026-59873

Code Behaviors & Features

Detect and mitigate CVE-2026-59873 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →