Security vulnerabilities and automated fixes for gzip bomb issues
2 posts found
A critical vulnerability (CVE-2026-59873) in node-tar versions prior to 7.5.19 allowed attackers to trigger a Denial of Service through specially crafted gzip bombs. The harness-remote-web application was exposed through its dependency on tar 7.5.15, which lacked proper decompression ratio validation. Upgrading to tar 7.5.21 in web/package-lock.json implements safeguards against malicious compressed archives.
CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` package (versions before 7.5.19) that allows an attacker to trigger resource exhaustion by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any Node.js application that processes tar archives. Because this package is used in production code — not just in tests — the exposure was real and immediate.