Skip to content
Fencer Vulns
medium 6.5

CVE-2024-28863 json

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

published 2024-03-21 2 y ago modified 2026-09-10 1 mo ago also GHSA-f5x3-32g6-xq36 , EUVD-2024-0909

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Patch / fix

  • npm node-tar 6.2.1
  • npm tar 6.2.1
  • node-tar_project node-tar 6.2.1
  • node-tar Debian 12 6.1.13+~cs7.0.5-1+deb12u1
  • node-tar Debian 14, Debian 13 6.1.13+~cs7.0.5-2

debian advisories DEBIAN-CVE-2024-28863

  • cjson satellite capsule 6.16, satellite 6.16 1.7.17-1.el8sat
  • cjson satellite capsule 6.16, satellite 6.16 1.7.17-1.el9sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.1-1.el8sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.1-1.el9sat
  • katello satellite capsule 6.16, satellite 6.16 4.14.0-0.1.rc2.el8sat
  • katello satellite capsule 6.16, satellite 6.16 4.14.0-0.1.rc2.el9sat
  • libsolv satellite capsule 6.16, satellite 6.16 1:0.7.20-6.el8sat
  • libcomps satellite capsule 6.16, satellite 6.16 0.1.21-1.el8pc

red hat advisories RHSA-2024:8906RHSA-2024:6147RHSA-2024:6148RHSA-2024:5814

  • npm AlmaLinux 9 1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81
  • nodejs AlmaLinux 9 1:18.20.4-1.module_el9.4.0+112+bb28ff81
  • nodejs-nodemon AlmaLinux 9 3.0.1-1.module_el9.2.0+36+853e48f5
  • nodejs-full-i18n AlmaLinux 9 1:18.20.4-1.module_el9.4.0+112+bb28ff81
  • nodejs-packaging AlmaLinux 9 2021.06-4.module_el9.1.0+13+d9a595ea
  • nodejs-packaging-bundler AlmaLinux 9 2021.06-4.module_el9.1.0+13+d9a595ea
  • npm AlmaLinux 8 1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792
  • nodejs AlmaLinux 8 1:18.20.4-1.module_el8.10.0+3890+5a092792

almalinux advisories ALSA-2024:6147ALSA-2024:6148ALSA-2024:5814

  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32322+a8b1fd01
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31770+0da7192d
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32045+2e5d342d
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32143+ae966e5b
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32144+1d29a396
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32185+bd121a25
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31770+0da7192d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.6.0+32045+2e5d342d

rocky linux advisories RLSA-2024:6147RLSA-2024:5814RLSA-2024:6148

  • nodejs Azure Linux 3.0 20.14.0-1
  • nodejs18 CBL-Mariner 2.0 18.20.3-1
  • reaper CBL-Mariner 2.0 3.1.1-17

azure linux advisories AZL-37115AZL-37121AZL-37136

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-28863 updated cvss 6.5

node-tar: denial of service while parsing a tar file due to lack of folders depth validation

  • Red Hat Cryostat 2 node-tar
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8 Red Hat OpenShift Serverless node-tar Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp-system Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    +2 more products
    Red Hat Developer Hub 1 rhdh-operator-container Red Hat Enterprise Linux 10 nodejs20
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse 7 node-tar
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 node-tar
    affected: workaround, no fix available
  • Red Hat JBoss Data Grid 7 node-tar
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) odh-operator-container, odh-dashboard-container
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    affected: workaround, no fix planned “Will not fix”
show 12 more
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-rhel8-operator, rhods/odh-dashboard-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8, devspaces/code-rhel8, devspaces/traefik-rhel8, devspaces/dashboard-rhel8, devspaces/pluginregistry-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/argo-rollouts-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Process Automation 7 node-tar
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Satellite 6 nodejs-node-gyp, nodejs-node-sass
    affected: workaround, no fix available
  • Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Pipelines version 1.16 for RHEL 8 openshift-pipelines/pipelines-nop-rhel8 v1.16.0-7, openshift-pipelines/pipelines-events-rhel8 v1.16.0-7, openshift-pipelines/pipelines-hub-ui-rhel8 v1.16.0-3, openshift-pipelines/pipelines-cli-tkn-rhel8 v1.16.0-7, openshift-pipelines/pipelines-hub-api-rhel8 v1.16.0-3, openshift-pipelines/pipelines-webhook-rhel8 v1.16.0-7, +22 more
    fixed: vendor fix RHEA-2024:7870
  • Red Hat Developer Hub 1.2 for RHEL 9 rhdh/rhdh-hub-rhel9 1.2-132
    fixed: vendor fix RHBA-2024:4924
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 18.20.4-1.module+el8.10.0+22199+56ea0ead, nodejs 20.16.0-1.module+el8.10.0+22203+a88c8310, nodejs-nodemon 3.0.1-1.module+el8.9.0+20473+c4e3d824, nodejs-nodemon 3.0.1-1.module+el8.10.0+21159+f5a7145d, npm 10.7.0-1.18.20.4.1.module+el8.10.0+22199+56ea0ead, npm 10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310, +6 more
    fixed: vendor fix RHSA-2024:6148
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 18.20.4-1.module+el9.4.0+22195+c221878e, nodejs-nodemon 3.0.1-1.module+el9.3.0+19762+d716bf3b, npm 10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e, nodejs-full-i18n 18.20.4-1.module+el9.4.0+22195+c221878e, nodejs-packaging 2021.06-4.module+el9.1.0+15718+e52ec601, nodejs-packaging-bundler 2021.06-4.module+el9.1.0+15718+e52ec601
    fixed: vendor fix RHSA-2024:6147
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.4-10
    fixed: vendor fix RHSA-2024:7164
  • Red Hat RHODF 4.16 for RHEL 9 odf4/mcg-core-rhel9 v4.16.0-60, odf4/odf-console-rhel9 v4.16.2-2, odf4/ocs-client-console-rhel9 v4.16.2-2, odf4/odf-multicluster-console-rhel9 v4.16.2-2
    fixed: vendor fix RHSA-2024:4591
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8
    +6 more products
    Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat build of Apache Camel - HawtIO 4 node-tar Red Hat Build of Keycloak node-tar Red Hat Developer Hub 1.2 for RHEL 9 rhdh/rhdh-rhel9-operator 1.2-127, rhdh/rhdh-operator-bundle 1.2-121 Red Hat Discovery 1 discovery-server-container Red Hat Enterprise Linux 8 grafana, mozjs60, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, +9 more
    not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.93% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm node-tar
<6.2.1
6.2.1
npm tar
<6.2.1
6.2.1

Affected products

  • isaacs node-tar
  • node-tar_project node-tar

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.