Security vulnerabilities and automated fixes for gzip bomb issues
6 posts found
A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in the `tar` npm package at version 2.2.2, used in the frontend dependency tree. An attacker could craft a malicious gzip bomb that, when processed by node-tar, would expand to consume all available memory and crash the application. The fix upgrades `tar` from the legacy 2.2.2 to 7.5.19, which includes decompression limits and removes the vulnerable `block-stream` dependency.
CVE-2026-59873 is a critical Denial of Service vulnerability in the node-tar package, where a specially crafted gzip bomb can exhaust server resources during archive extraction. The fix upgrades tar from version 7.5.16 to 7.5.22 (pinned at `^7.5.19`) in the `@xen-orchestra/backups` package, closing the attack surface against resource exhaustion attacks targeting backup workflows.
CVE-2026-59873 is a critical Denial of Service vulnerability in node-tar versions prior to 7.5.19, where a maliciously crafted gzip bomb can exhaust server resources when extracting archives. The fix upgrades the `tar` dependency from version 7.5.15 to 7.5.21 in `package-lock.json` and pins the version via an `overrides` block in `package.json`. Any application that processes user-supplied tar archives is at risk of resource exhaustion, making this an urgent upgrade.
A critical vulnerability (CVE-2026-59873) in node-tar versions prior to 7.5.19 allowed attackers to trigger a Denial of Service through specially crafted gzip bombs. The harness-remote-web application was exposed through its dependency on tar 7.5.15, which lacked proper decompression ratio validation. Upgrading to tar 7.5.21 in web/package-lock.json implements safeguards against malicious compressed archives.
A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in the node-tar package where attackers could craft malicious gzip archives that expand to consume all available system resources. This vulnerability affected version 7.5.15 of the tar package and was fixed by upgrading to version 7.5.19. The fix protects applications from resource exhaustion attacks when processing untrusted archive files.
CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` package (versions before 7.5.19) that allows an attacker to trigger resource exhaustion by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any Node.js application that processes tar archives. Because this package is used in production code — not just in tests — the exposure was real and immediate.