Skip to content
Fencer Intel
medium 6.5

CVE-2024-28863 json

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

published 2y ago modified 2mo ago also EUVD-2024-0909 , GHSA-f5x3-32g6-xq36

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Patch / fix

  • npm node-tar 6.2.1
  • npm tar 6.2.1
  • node-tar_project node-tar 6.2.1
  • node-tar Debian 12 6.1.13+~cs7.0.5-1+deb12u1
  • node-tar Debian 14, Debian 13 6.1.13+~cs7.0.5-2

debian advisories DEBIAN-CVE-2024-28863

  • cjson satellite capsule 6.16, satellite 6.16 1.7.17-1.el8sat
  • cjson satellite capsule 6.16, satellite 6.16 1.7.17-1.el9sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.1-1.el8sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.1-1.el9sat
  • katello satellite capsule 6.16, satellite 6.16 4.14.0-0.1.rc2.el8sat
  • katello satellite capsule 6.16, satellite 6.16 4.14.0-0.1.rc2.el9sat
  • libsolv satellite capsule 6.16, satellite 6.16 1:0.7.20-6.el8sat
  • libcomps satellite capsule 6.16, satellite 6.16 0.1.21-1.el8pc

red hat advisories RHSA-2024:8906RHSA-2024:6147RHSA-2024:6148RHSA-2024:5814

  • npm AlmaLinux 9 1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81
  • nodejs AlmaLinux 9 1:18.20.4-1.module_el9.4.0+112+bb28ff81
  • nodejs-nodemon AlmaLinux 9 3.0.1-1.module_el9.2.0+36+853e48f5
  • nodejs-full-i18n AlmaLinux 9 1:18.20.4-1.module_el9.4.0+112+bb28ff81
  • nodejs-packaging AlmaLinux 9 2021.06-4.module_el9.1.0+13+d9a595ea
  • nodejs-packaging-bundler AlmaLinux 9 2021.06-4.module_el9.1.0+13+d9a595ea
  • npm AlmaLinux 8 1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792
  • nodejs AlmaLinux 8 1:18.20.4-1.module_el8.10.0+3890+5a092792

almalinux advisories ALSA-2024:6147ALSA-2024:6148ALSA-2024:5814

  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32322+a8b1fd01
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31770+0da7192d
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32045+2e5d342d
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32143+ae966e5b
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32144+1d29a396
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32185+bd121a25
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31770+0da7192d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.6.0+32045+2e5d342d

rocky linux advisories RLSA-2024:6147RLSA-2024:5814RLSA-2024:6148

  • nodejs Azure Linux 3.0 20.14.0-1
  • nodejs18 CBL-Mariner 2.0 18.20.3-1
  • reaper CBL-Mariner 2.0 3.1.1-17

azure linux advisories AZL-37115AZL-37121AZL-37136

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2024-28863 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-28863 updated cvss 6.5

node-tar: denial of service while parsing a tar file due to lack of folders depth validation

  • Red Hat Cryostat 2 node-tar
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8 Red Hat OpenShift Serverless node-tar Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp-system Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    +2 more products
    Red Hat Developer Hub 1 rhdh-operator-container Red Hat Enterprise Linux 10 nodejs20
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse 7 node-tar
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 node-tar
    affected: workaround, no fix available
  • Red Hat JBoss Data Grid 7 node-tar
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) odh-operator-container, odh-dashboard-container
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    affected: workaround, no fix planned “Will not fix”
show 12 more
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-rhel8-operator, rhods/odh-dashboard-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8, devspaces/code-rhel8, devspaces/traefik-rhel8, devspaces/dashboard-rhel8, devspaces/pluginregistry-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/argo-rollouts-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Process Automation 7 node-tar
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Satellite 6 nodejs-node-gyp, nodejs-node-sass
    affected: workaround, no fix available
  • Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Pipelines version 1.16 for RHEL 8 openshift-pipelines/pipelines-nop-rhel8 v1.16.0-7, openshift-pipelines/pipelines-events-rhel8 v1.16.0-7, openshift-pipelines/pipelines-hub-ui-rhel8 v1.16.0-3, openshift-pipelines/pipelines-cli-tkn-rhel8 v1.16.0-7, openshift-pipelines/pipelines-hub-api-rhel8 v1.16.0-3, openshift-pipelines/pipelines-webhook-rhel8 v1.16.0-7, +22 more
    fixed: vendor fix RHEA-2024:7870
  • Red Hat Developer Hub 1.2 for RHEL 9 rhdh/rhdh-hub-rhel9 1.2-132
    fixed: vendor fix RHBA-2024:4924
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 18.20.4-1.module+el8.10.0+22199+56ea0ead, nodejs 20.16.0-1.module+el8.10.0+22203+a88c8310, nodejs-nodemon 3.0.1-1.module+el8.9.0+20473+c4e3d824, nodejs-nodemon 3.0.1-1.module+el8.10.0+21159+f5a7145d, npm 10.7.0-1.18.20.4.1.module+el8.10.0+22199+56ea0ead, npm 10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310, +6 more
    fixed: vendor fix RHSA-2024:6148
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 18.20.4-1.module+el9.4.0+22195+c221878e, nodejs-nodemon 3.0.1-1.module+el9.3.0+19762+d716bf3b, npm 10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e, nodejs-full-i18n 18.20.4-1.module+el9.4.0+22195+c221878e, nodejs-packaging 2021.06-4.module+el9.1.0+15718+e52ec601, nodejs-packaging-bundler 2021.06-4.module+el9.1.0+15718+e52ec601
    fixed: vendor fix RHSA-2024:6147
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.4-10
    fixed: vendor fix RHSA-2024:7164
  • Red Hat RHODF 4.16 for RHEL 9 odf4/mcg-core-rhel9 v4.16.0-60, odf4/odf-console-rhel9 v4.16.2-2, odf4/ocs-client-console-rhel9 v4.16.2-2, odf4/odf-multicluster-console-rhel9 v4.16.2-2
    fixed: vendor fix RHSA-2024:4591
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8
    +6 more products
    Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat build of Apache Camel - HawtIO 4 node-tar Red Hat Build of Keycloak node-tar Red Hat Developer Hub 1.2 for RHEL 9 rhdh/rhdh-rhel9-operator 1.2-127, rhdh/rhdh-operator-bundle 1.2-121 Red Hat Discovery 1 discovery-server-container Red Hat Enterprise Linux 8 grafana, mozjs60, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, +9 more
    not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.93% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm node-tar
<6.2.1
6.2.1
npm tar
<6.2.1
6.2.1

Affected products

  • isaacs node-tar
  • node-tar_project node-tar

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of isaacs/node-tar published their own advisory on GitHub. Reviewed sources take precedence over it.