CVE-2026-59873

What it actually does

CVE-2026-59873 is a denial-of-service flaw in node-tar, the tar archive manipulation library for Node.js. Versions prior to 7.5.19 do not enforce hard limits on total decompressed output size, archive entry count, or decompression ratio during archive extraction and parsing. An attacker can supply a small crafted gzip-compressed tar archive that expands disproportionately or contains excessive entries, causing the consuming Node.js process to spend excessive CPU cycles and/or fill available disk space. The impact is availability loss rather than direct code execution, data theft, or privilege escalation.

Why it matters to the business

Applications, build systems, package ingestion services, CI/CD jobs, artifact scanners, upload processors, or developer tooling that automatically parse or extract untrusted tar or tar.gz files may be disrupted by a small malicious archive. Successful exploitation can cause service outages, failed deployments, exhausted storage, degraded host performance, and operational recovery work such as cleanup, restarts, or reprovisioning. The CVSS availability impact is high, exploit code is reportedly available, and although EPSS is currently low and the issue is not in CISA KEV, internet-facing or automated archive-processing workflows should be prioritized because exploitation requires no authentication or user interaction when an attacker can submit an archive.

How an attack unfolds

An attacker identifies an application or automation path that accepts or retrieves tar/gzip archives and processes them with a vulnerable node-tar version before 7.5.19. The attacker crafts a gzip bomb or archive with an extreme compression ratio, very large decompressed size, or excessive number of entries. They submit the archive through an upload feature, package ingestion workflow, CI job input, dependency/artifact fetch path, or any API that causes the server-side Node.js process to parse or extract it. Because vulnerable node-tar versions lack strict extraction limits, the process continues expanding or enumerating archive content until CPU is saturated, disk space is exhausted, temporary directories grow uncontrollably, or the Node.js process crashes. The result is denial of service for the affected application or host, and in shared environments may affect colocated workloads through resource starvation.

How to fix it

Upgrade node-tar to version 7.5.19 or later everywhere it is used, including transitive dependency paths in applications, build tooling, scanners, package ingestion systems, and CI/CD workers. If direct upgrade is not immediately possible, use package manager overrides/resolutions to force tar/node-tar to 7.5.19 or later where compatible, then rebuild and redeploy affected artifacts. Add defense-in-depth controls for all archive handling: reject archives above a defined compressed size, enforce maximum decompressed bytes, enforce maximum file count, enforce maximum directory depth and filename length, bound extraction time, extract into isolated temporary directories or containers with disk quotas, and run archive processing with CPU, memory, and filesystem limits. Avoid extracting untrusted archives on shared or critical hosts. Ensure temporary directories are cleaned after failed extraction and that monitoring alerts on abnormal disk growth and archive-processing failures.

How to confirm the fix worked

Inventory Node.js projects and runtime images for the tar package and confirm the resolved version is 7.5.19 or later using package lockfiles, SBOMs, container image scans, and runtime dependency inspection. Check package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, and node_modules/tar/package.json for versions below 7.5.19. Verify that deployed containers or serverless bundles contain the upgraded dependency, not just source repositories. Exercise archive-ingestion paths with benign oversized test archives in a controlled environment to confirm configured limits stop extraction before disk or CPU exhaustion. Validate that monitoring detects abnormal temporary-directory growth, high CPU from Node.js workers, repeated extraction failures, and ENOSPC conditions.

Typical attack path

1. Find a service, API, build job, or automation workflow that accepts or downloads tar or tar.gz archives.
2. Confirm the workflow processes the archive with node-tar prior to version 7.5.19 or with no independent decompression limits.
3. Create a small malicious gzip/tar archive with a very high decompression ratio, excessive total expanded size, or excessive entry count.
4. Submit or cause the target to retrieve the archive.
5. Allow extraction or parsing to consume CPU, disk, temporary storage, or process memory.
6. Trigger application errors, worker crashes, failed jobs, host-level resource exhaustion, or service unavailability.

How to detect it

To determine whether exploitation already occurred, review application logs, worker logs, upload/access logs, CI/CD job logs, container runtime logs, host telemetry, and filesystem monitoring around archive upload or extraction events. Look for a pattern where a tar, tgz, or tar.gz file is received or processed shortly before sudden CPU spikes, rapid growth in temporary extraction directories, disk-full errors, failed jobs, Node.js crashes, container restarts, or service health-check failures. Correlate web/API requests that submitted archive files with downstream extraction errors and host metrics. Investigate unusually small compressed archives that produce very large temporary output, archives with unusually high file counts, or repeated failed extraction attempts from the same source. For forensics, preserve suspicious uploaded archives, temporary extraction directories, application request metadata, process accounting data, and container logs before cleanup. There are no unique network indicators for this vulnerability; detection is primarily behavioral and log-based.

• ENOSPC: no space left on device
• npm ERR! code ENOSPC
• JavaScript heap out of memory
• FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
• Error: ENOSPC
• no space left on device
• tar.gz
• tgz
• node_modules/tar/package.json
• "tar": "7.5.18"
• "tar":"7.5.18"
• "tar": "7.5.17"
• "tar":"7.5.17"
• "tar": "7.5.16"
• "tar":"7.5.16"

What your security team should do

• Prioritize patching internet-facing, unauthenticated, or automated archive-processing services that use node-tar before 7.5.19.
• Upgrade or force-resolve node-tar to 7.5.19 or later across application, CI/CD, build, artifact, and scanning environments.
• Search repositories, lockfiles, SBOMs, and container images for vulnerable tar package versions and track remediation to deployed runtime artifacts.
• Add resource limits around archive extraction, including decompressed-size, entry-count, time, CPU, memory, and disk-quota controls.
• Review upload and artifact-ingestion endpoints to ensure untrusted archives are processed in isolated workers or sandboxes rather than on shared production hosts.
• Add alerts for rapid disk consumption, temporary directory expansion, high CPU in Node.js archive workers, repeated extraction failures, and ENOSPC errors.
• Review recent logs for suspicious archive uploads or extraction jobs followed by resource exhaustion, crashes, or service restarts.