CVE-2024-28863

MEDIUM EPSS 56.1%
Published Mar 21, 20242y ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Mar 21, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
56.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-400 Uncontrolled Resource Consumption Resource Mgmt
CWE-770

Affected Products 1

VendorProductVersionRange
isaacstar* <6.2.1

References 3

  • github.com https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
    Patch
  • github.com https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
    ExploitVendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20240524-0005/
    Third Party Advisory

Remediation

  • github.com https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
    Patch