High [CVE-2026-59873] Denial of Service via crafted gzip bomb

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.

This issue is fixed in version 7.5.19. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources.

The primary impact is a Denial of Service (DoS), making the affected system or application unavailable. This vulnerability in node-tar is rated as Important.

A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library's archive processing to craft a gzip bomb. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-770.

Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Ansible Automation Platform 2.2; and 30 more.

Affected products named by the advisory: Red Hat OpenShift AI 3.4; Red Hat OpenShift Container Platform 4.20; Red Hat OpenShift Container Platform 4.21; Red Hat OpenShift Container Platform 4.22; and 26 more.