Critical DoS Flaw Found in npm tar Package

A critical vulnerability, identified as CVE-2026-59873, has been discovered in the node-tar package for Node.js. The flaw allows an attacker to trigger a denial-of-service (DoS) condition by providing a specially crafted archive that forces the system to exhaust its available disk space and CPU resources during the extraction process.

What's at Risk

The vulnerability affects all versions of the npm/tar package prior to version 7.5.19. Any application or backend service that utilizes this library to process user-uploaded archives or external data streams is potentially at risk of total service disruption.

Organizations that deploy internet-facing services allowing file uploads are most exposed to this threat. Because the library lacks internal mechanisms to limit total decompressed data, a small malicious input can effectively render a server unusable by filling its storage capacity almost instantaneously.

How the Flaw Works

This vulnerability falls into the category of decompression bombs, a technique where highly compressed data expands into a massive volume of output. In general, software that processes compressed archives must implement strict resource constraints to prevent uncontrolled expansion. Without these bounds, an application will blindly follow instructions within the archive header to write data to disk until the physical storage is completely exhausted or the system crashes under the load.

Attackers typically exploit this class of weakness by providing a header that claims a file is significantly larger than its actual compressed size. When the application attempts to extract this file, the underlying library processes the stream without verifying the total bytes against a maximum threshold. This leads to a resource exhaustion state where the application hangs or the host operating system fails to perform basic operations due to a lack of disk space.

How to Protect Your Systems

• Update the npm/tar package to version 7.5.19 or later immediately to incorporate the necessary resource constraints.
• Implement strict input validation for all user-uploaded files, including checking file size and type before passing data to extraction libraries.
• Configure your application environment with disk quotas or resource limits to mitigate the impact of unexpected file expansion.
• Monitor server logs and system resource metrics for unusual spikes in CPU usage or rapid depletion of disk space during file processing tasks.
• Restrict the permissions of the service account running the Node.js application to prevent it from writing to unauthorized directories or exceeding safe storage limits.

Given the critical CVSS score of 7.5, administrators should prioritize patching their dependencies. Failure to address this flaw leaves infrastructure vulnerable to simple, automated attacks that can cause significant downtime for critical services. Promptly applying the vendor-provided patch is the most effective way to eliminate this risk.