Bug 2498120 (CVE-2026-59873)

Summary: CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, abarbaro, abrianik, akostadi, alizardo, amasferr, anthomas, anujha, aruklets, aschwart, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, boliveir, bstansbe, cdrage, cmah, dbruscin, dfreiber, dlofthou, dmayorov, doconnor, drichtar, drow, dschmidt, dymurray, eaguilar, ebaron, eborisov, ehelms, ehugonne, fmariani, ggainey, ggrzybek, gmalinko, gparvin, ibolton, istudens, ivassile, iweiss, janstey, jburrell, jchui, jhe, jlanda, jlledo, jmatthew, jmontleo, jolong, jpasqual, jraez, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, manissin, mcarlett, mhulan, mosmerov, mposolda, mstipich, msvehla, nboldt, ngough, nmoumoul, nwallace, oaljalju, osousa, pantinor, parichar, pberan, pcreech, pesilva, pgaikwad, pjindal, pmackay, psrna, rchan, rekumar, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, simaishi, slucidi, smallamp, sseago, ssilvert, stcannon, sthirugn, sthorger, tasato, tcunning, teagle, thjenkin, tmalecek, tsedmik, vdosoudi, veshanka, vkumar, vmuzikar, vvoronko, watson-tool-maintainers, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2498755, 2498756, 2498758, 2498759, 2498760, 2498761, 2498763, 2498764, 2498765, 2498766, 2498767, 2498768, 2498769, 2498757, 2498762    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-08 16:01:54 UTC
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.