Executive brief
node-tar is a popular Node.js library used to extract tar archives in applications ranging from npm package managers to CI/CD pipelines. An attacker can craft a malicious compressed archive that expands from kilobytes to gigabytes during extraction, filling up a server's disk and causing complete service outage. This is particularly dangerous in automated systems that process user-supplied files without resource restrictions.
Technical details
This is a resource exhaustion vulnerability (CWE-770) in the extraction logic of node-tar. The root cause is the absence of enforced limits on total decompressed data volume, entry counts, or decompression ratios in the Unpack stream (src/extract.ts). While the maxReadSize option exists, it only controls internal read buffer size (default 16MB) and does not limit cumulative bytes written to disk. An attacker provides a TAR archive with a header declaring an extremely large file size (e.g., 10GB) followed by highly compressible payload (e.g., all zeros), which gzip compresses to minimal size. The extraction process reads the header, allocates and writes data unbounded until physical disk exhaustion, with no mechanism to abort based on global resource consumption. The attack requires no authentication and is exploitable over the network (e.g., via npm registry, file-sharing API, or CI/CD artifact upload). Patch version 7.5.19 introduces a maxDecompressionRatio option (default 1000:1) to guard against explosive decompression.
Affected products
- npm tar <=7.5.18
Timeline
- 2026-06-27: disclosed
- 2026-06-27: patched: version 7.5.19 released