Tar version 4.4.19 is a minor update to the popular tar package for Node.js, building upon the previous stable version 4.4.18. Both versions provide robust tar archive creation and extraction capabilities, essential for developers working with file packaging, backups, and deployments. The core dependencies remain identical, ensuring a consistent base functionality. These include packages like chownr, mkdirp, yallist, minipass, minizlib, fs-minipass, and safe-buffer, which handle file ownership changes, directory creation, efficient data streaming, and safe buffer manipulation.
The development dependencies, used for testing and building the package, are also unchanged. This suggests that the update primarily focuses on internal improvements rather than introducing new APIs or features. The most noticeable difference is a slight increase in the unpacked size, from 150645 bytes in 4.4.18 to 150649 bytes in 4.4.19. This small change likely indicates minor code adjustments, bug fixes, or performance enhancements. The release dates, differing by a few minutes, confirm a rapid succession between the two versions.
For developers, upgrading to 4.4.19 offers the benefits of potential bug fixes and optimizations without requiring any code modifications, provided they haven't encountered specific issues addressed in this patch. The tar package, in both versions, remains a reliable and well-maintained solution for archive handling in Node.js environments, supported by a comprehensive suite of development tools for stability and quality assurance. The maintainer is also the author, so all bug fixes or improvements are expected to be high quality.
All the vulnerabilities related to the version 4.4.19 of the package
Denial of service while parsing a tar file due to lack of folders count validation
During some analysis today on npm's node-tar package I came across the folder creation process, Basicly if you provide node-tar with a path like this ./a/b/c/foo.txt it would create every folder and sub-folder here a, b and c until it reaches the last folder to create foo.txt, In-this case I noticed that there's no validation at all on the amount of folders being created, that said we're actually able to CPU and memory consume the system running node-tar and even crash the nodejs client within few seconds of running it using a path with too many sub-folders inside
You can reproduce this issue by downloading the tar file I provided in the resources and using node-tar to extract it, you should get the same behavior as the video
Here's a video show-casing the exploit:
Denial of service by crashing the nodejs client when attempting to parse a tar archive, make it run out of heap memory and consuming server CPU and memory resources
This report was originally reported to GitHub bug bounty program, they asked me to report it to you a month ago
