CVE-2024-28863

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
isaacs	node-tar	< 6.2.1
node-tar_project	node-tar	< 6.2.1

References

https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7Patch
https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36Exploit, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240524-0005/Third Party Advisory
https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7Patch
https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36Exploit, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240524-0005/Third Party Advisory

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-288642.6SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps CVE-2024-288657.5django-wiki is a wiki system for Django. Installations of django-wiki prior to version 0.10.1 are vulnerable to maliciously crafted article CVE-2024-288666.1GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site s CVE-2024-288677.4Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _CVE-2024-288685.3Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possib CVE-2024-288697.5Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-len CVE-2024-28877.7Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML CVE-2024-288707.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF a CVE-2024-288717.5LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic,CVE-2024-288728.1The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the S CVE-2024-288758.1A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the CVE-2024-288767.3Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable