01 Record

CVE-2024-28863

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

MediumPUBLISHEDCNA: GitHub_M

CNA base score6.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

View raw JSON

02 Description

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

03 Exploitation and scoring

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.92% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 60.2% of scored records. A rank, not a probability.

NVD base score

6.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD analysis status

Analyzed. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-03-21 22:10Z2 YR AGO

Last updated

2025-02-13 17:47Z1 YR AGO

Reserved

2024-03-11

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

Medium (CVSS 6.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses

CWE-400Uncontrolled Resource ConsumptionClass
CWE-770Allocation of Resources Without Limits or ThrottlingBase

Data version

5.1

Document digest

5c7d365f7bed14f080000208f22f623a5203cbf11a5f06be4bbbcbbbd7c9959e

05 Affected products

VendorProductVersionsPlatforms

isaacsnode-tar< 6.2.1—

node-tar_projectnode-tar0 to < 6.2.1—

06 References

github.comhttps://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36x_refsource_CONFIRM
github.comhttps://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7x_refsource_MISC
security.netapp.comhttps://security.netapp.com/advisory/ntap-20240524-0005/

07 Fixed in

AlmaLinux 8

nodejs
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-devel
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-full-i18n
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 3.0.1-1.module_el8.8.0+3613+1ed8c91d
- Affected before 3.0.1-1.module_el8.9.0+3731+490e3ce5
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 2021.06-4.module_el8.7.0+3343+ea2b7901
- Affected before 2021.06-4.module_el8.9.0+3775+d8460d35
nodejs-packaging-bundler
Fixed

A version is affected if any line below covers it.
- Affected before 2021.06-4.module_el8.7.0+3343+ea2b7901
- Affected before 2021.06-4.module_el8.9.0+3775+d8460d35
npm
Fixed

A version is affected if any line below covers it.
- Affected before 1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792
- Affected before 1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db

AlmaLinux 9

nodejs
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-devel
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-docs
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-full-i18n
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-nodemon
Fixed in 3.0.1-1.module_el9.2.0+36+853e48f5
nodejs-packaging
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
npm
Fixed in 1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81

CloudLinux 8

nodejs
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-devel
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-full-i18n
Fixed

A version is affected if any line below covers it.
- Affected before 1:18.20.4-1.module_el8.10.0+3890+5a092792
- Affected before 1:20.16.0-1.module_el8.10.0+3882+e12e42db
nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 3.0.1-1.module_el8.8.0+3613+1ed8c91d
- Affected before 3.0.1-1.module_el8.9.0+3731+490e3ce5
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 2021.06-4.module_el8.7.0+3343+ea2b7901
- Affected before 2021.06-4.module_el8.9.0+3775+d8460d35
nodejs-packaging-bundler
Fixed

A version is affected if any line below covers it.
- Affected before 2021.06-4.module_el8.7.0+3343+ea2b7901
- Affected before 2021.06-4.module_el8.9.0+3775+d8460d35
npm
Fixed

A version is affected if any line below covers it.
- Affected before 1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792
- Affected before 1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

CloudLinux 9

nodejs
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-devel
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-docs
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-full-i18n
Fixed in 1:18.20.4-1.module_el9.4.0+112+bb28ff81
nodejs-nodemon
Fixed in 3.0.1-1.module_el9.2.0+36+853e48f5
nodejs-packaging
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
npm
Fixed in 1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Debian 12

node-tar
Fixed in 6.1.13+~cs7.0.5-1+deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

node-tar
Fixed in 6.1.13+~cs7.0.5-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

node-tar
Fixed in 6.1.13+~cs7.0.5-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

node-tar
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

node-tar
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 20.04 LTS

node-tar
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.