CVE-2026-59873: node-tar: Decompression/parse DoS via unlimited input

July 20, 2026

A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources (disk space and CPU). Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted “Gzip Bomb” can be used to fill a server’s storage and crash services.

References

github.com/advisories/GHSA-23hp-3jrh-7fpw
github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3
github.com/isaacs/node-tar/releases/tag/v7.5.19
github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw
nvd.nist.gov/vuln/detail/CVE-2026-59873

Code Behaviors & Features

Detect and mitigate CVE-2026-59873 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →