node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation
Priority MEDIUM 62CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 22 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00929 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial node-tar (isaacs): 6.2.1node-tar (npm): 6.2.1+1 more productRed Hat: 7 advisoriesRed Hat: 6 fixed, 22 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| isaacs | node-tar | before 6.2.1 | 6.2.1 | Patch available | CNA |
| — | node-tar (npm) | before 6.2.1 | 6.2.1 | Patch available | GHSA-f5x3-32g6-xq36 |
| — | tar (npm) | before 6.2.1 | 6.2.1 | Patch available | GHSA-f5x3-32g6-xq36 |
- node-tar Vendorisaacs Affected before 6.2.1 Fixed in 6.2.1 Patch available CNA
- node-tar (npm) Vendor— Affected before 6.2.1 Fixed in 6.2.1 Patch available GHSA-f5x3-32g6-xq36
- tar (npm) Vendor— Affected before 6.2.1 Fixed in 6.2.1 Patch available GHSA-f5x3-32g6-xq36
Remediation
- Fix · CNA node-tar (isaacs) Fixed in 6.2.1
- Fix · GHSA-f5x3-32g6-xq36 node-tar (npm) Fixed in 6.2.1 Advisory →
- Fix · GHSA-f5x3-32g6-xq36 tar (npm) Fixed in 6.2.1 Advisory →
Red Hat 7 advisories
- RHSA-2024:8906 Released 2024-11-05 · Red Hat rating CriticalSatellite 6.16.0 release
- Red Hat Satellite 6.16 for RHEL 8 ansible-collection-redhat-satellite-4.2.0-1.el8sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el8sat, ansible-lint-5.4.0-1.el8pc +47
- Red Hat Satellite 6.16 for RHEL 9 ansible-collection-redhat-satellite-4.2.0-1.el9sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el9sat, ansible-runner-2.2.1-5.el9pc +47
- RHSA-2024:7164 Released 2024-09-26 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.4 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8
- RHSA-2024:6755 Released 2024-09-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.2 security and bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9 +7
Show 4 more Red Hat advisories
- RHSA-2024:6148 Released 2024-09-03 · Red Hat rating Moderatenodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.20.4-1.module+el8.10.0+22199+56ea0ead.aarch64::nodejs:18, nodejs-1:18.20.4-1.module+el8.10.0+22199+56ea0ead.ppc64le::nodejs:18, nodejs-1:18.20.4-1.module+el8.10.0+22199+56ea0ead.s390x::nodejs:18 +20
- RHSA-2024:6147 Released 2024-09-03 · Red Hat rating Moderatenodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.20.4-1.module+el9.4.0+22195+c221878e.aarch64::nodejs:18, nodejs-1:18.20.4-1.module+el9.4.0+22195+c221878e.ppc64le::nodejs:18, nodejs-1:18.20.4-1.module+el9.4.0+22195+c221878e.s390x::nodejs:18 +20
- RHSA-2024:5814 Released 2024-08-26 · Red Hat rating Moderatenodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.16.0-1.module+el8.10.0+22203+a88c8310.aarch64::nodejs:20, nodejs-1:20.16.0-1.module+el8.10.0+22203+a88c8310.ppc64le::nodejs:20, nodejs-1:20.16.0-1.module+el8.10.0+22203+a88c8310.s390x::nodejs:20 +20
- RHSA-2024:4591 Released 2024-07-17 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 10 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix planned: Out of support scope |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:7164 |
| OpenShift Pipelines version 1.16 for RHEL 8 | Fixed | — |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:4591, RHSA-2024:6755 |
| Red Hat Developer Hub 1.2 for RHEL 9 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:5814, RHSA-2024:6148 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:6147 |
Not affected: 20 products
- 8Base-RHMTC-1.8
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Network Observability Operator
- RHODF 4.16 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 3
- Red Hat Advanced Cluster Security 4
- Red Hat Build of Keycloak
- Red Hat Developer Hub 1.2 for RHEL 9
- Red Hat Discovery 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28863
- 2026-10-03 Alias added: GHSA-f5x3-32g6-xq36
- 2026-10-27 Affected versions changed · Red Hat
References
Advisory 2
More isaacs Tar vulnerabilities
- TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
- TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
- TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
- TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
- TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
- TI-2026-20041 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal CVSS 3.1HIGH 8.2
Sources
- CVE-2024-28863 · CVE Program
- CVE-2024-28863 · NVD
- FIRST EPSS
- GHSA-f5x3-32g6-xq36 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-28863 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences