Category

Gzip Bomb

Security vulnerabilities and automated fixes for gzip bomb issues

6 posts found

critical7 min

How Denial of Service via Gzip Bomb happens in Node.js tar and how to fix it

A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in the `tar` npm package at version 2.2.2, used in the frontend dependency tree. An attacker could craft a malicious gzip bomb that, when processed by node-tar, would expand to consume all available memory and crash the application. The fix upgrades `tar` from the legacy 2.2.2 to 7.5.19, which includes decompression limits and removes the vulnerable `block-stream` dependency.

#security#denial-of-service#nodejs+3 more
A
anupamme
Sep 6, 2026
critical6 min

How Denial of Service via Gzip Bomb happens in Node.js and how to fix it

CVE-2026-59873 is a critical Denial of Service vulnerability in the node-tar package, where a specially crafted gzip bomb can exhaust server resources during archive extraction. The fix upgrades tar from version 7.5.16 to 7.5.22 (pinned at `^7.5.19`) in the `@xen-orchestra/backups` package, closing the attack surface against resource exhaustion attacks targeting backup workflows.

#security#denial-of-service#nodejs+4 more
A
anupamme
Aug 26, 2026
critical8 min

How Denial of Service via Gzip Bomb happens in Node.js and how to fix it

CVE-2026-59873 is a critical Denial of Service vulnerability in node-tar versions prior to 7.5.19, where a maliciously crafted gzip bomb can exhaust server resources when extracting archives. The fix upgrades the `tar` dependency from version 7.5.15 to 7.5.21 in `package-lock.json` and pins the version via an `overrides` block in `package.json`. Any application that processes user-supplied tar archives is at risk of resource exhaustion, making this an urgent upgrade.

#security#denial-of-service#nodejs+3 more
A
anupamme
Aug 24, 2026
critical8 min

How Denial of Service via Gzip Bombs happens in Node.js and how to fix it

A critical vulnerability (CVE-2026-59873) in node-tar versions prior to 7.5.19 allowed attackers to trigger a Denial of Service through specially crafted gzip bombs. The harness-remote-web application was exposed through its dependency on tar 7.5.15, which lacked proper decompression ratio validation. Upgrading to tar 7.5.21 in web/package-lock.json implements safeguards against malicious compressed archives.

#nodejs#denial-of-service#gzip-bomb+4 more
A
anupamme
Aug 20, 2026
critical5 min

How Denial of Service via gzip bomb happens in Node.js tar and how to fix it

A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in the node-tar package where attackers could craft malicious gzip archives that expand to consume all available system resources. This vulnerability affected version 7.5.15 of the tar package and was fixed by upgrading to version 7.5.19. The fix protects applications from resource exhaustion attacks when processing untrusted archive files.

#security#denial-of-service#node-tar+4 more
A
anupamme
Jul 28, 2026
critical8 min

How Denial of Service via gzip bomb happens in Node.js tar and how to fix it

CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` package (versions before 7.5.19) that allows an attacker to trigger resource exhaustion by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any Node.js application that processes tar archives. Because this package is used in production code — not just in tests — the exposure was real and immediate.

#security#nodejs#denial-of-service+5 more
A
anupamme
Jul 26, 2026