Is CVE-2026-59873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59873 being exploited in the wild.

How severe is CVE-2026-59873?

High severity, with a CVSS score of 7.5, published 8 July 2026.

Which products and versions are affected?

tar (npm) SEMVER:introduced=0,fixed=7.5.19.

Is there a fix for CVE-2026-59873?

Yes. tar (npm): upgrade to 7.5.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59873 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59873?

Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59873: isaacs node-tar Denial of Service via Gzip Bomb

CVE-2026-59873 · Severity: high · CVSS 7.5 · Published 2026-07-08

node-tar is a popular Node.js library used to extract tar archives in applications ranging from npm package managers to CI/CD pipelines. An attacker can craft a malicious compressed archive that expands from kilobytes to gigabytes during extraction, filling up a server's disk and causing complete service outage. This is particularly dangerous in automated systems that process user-supplied files without resource restrictions.

Technologies: tar (npm). Vendors: npm.

Quick answers

Is CVE-2026-59873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59873 being exploited in the wild.
How severe is CVE-2026-59873?: High severity, with a CVSS score of 7.5, published 8 July 2026.
Which products and versions are affected?: tar (npm) SEMVER:introduced=0,fixed=7.5.19.
Is there a fix for CVE-2026-59873?: Yes. tar (npm): upgrade to 7.5.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59873 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59873?: Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tar (npm): upgrade to 7.5.19 or later
```
npm install tar@7.5.19
```

Technical details

This is a resource exhaustion vulnerability (CWE-770) in the extraction logic of node-tar. The root cause is the absence of enforced limits on total decompressed data volume, entry counts, or decompression ratios in the Unpack stream (src/extract.ts). While the maxReadSize option exists, it only controls internal read buffer size (default 16MB) and does not limit cumulative bytes written to disk. An attacker provides a TAR archive with a header declaring an extremely large file size (e.g., 10GB) followed by highly compressible payload (e.g., all zeros), which gzip compresses to minimal size. The extraction process reads the header, allocates and writes data unbounded until physical disk exhaustion, with no mechanism to abort based on global resource consumption. The attack requires no authentication and is exploitable over the network (e.g., via npm registry, file-sharing API, or CI/CD artifact upload). Patch version 7.5.19 introduces a maxDecompressionRatio option (default 1000:1) to guard against explosive decompression.

Affected products

npm tar <=7.5.18

Identifiers

CVE-2026-59873
GHSA-23hp-3jrh-7fpw

Timeline

2026-06-27: disclosed
2026-06-27: patched: version 7.5.19 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.