CVE-2026-59873

Name	CVE-2026-59873
Description	node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1141767

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-tar (PTS)	bullseye	6.0.5+ds1+~cs11.3.9-1+deb11u2	vulnerable
	bullseye (security)	6.0.5+ds1+~cs11.3.9-1+deb11u3	vulnerable
	bookworm	6.1.13+~cs7.0.5-1	vulnerable
	trixie	6.2.1+~cs7.0.8-1+deb13u1	vulnerable
	forky	6.2.1+ds1+~cs6.1.13-10	vulnerable
	sid	7.5.19+~4.0.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-tar	source	(unstable)	7.5.19+~4.0.1-1			1141767

Notes

[trixie] - node-tar <no-dsa> (Minor issue)
https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw
Fixed by: https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3 (v7.5.19)