The flaw is a memory exhaustion vulnerability in the modern-tar library that arises when readOctal() parses malformed archive entries. Non‑octal bytes in an entry’s size field are coerced into negative values, causing unpackTar() to repeatedly buffer the entry’s data. An attacker can craft a single or multiple entries, optionally gzip‑compressing the archive, so that the process’s memory grows without bound and later entries are suppressed.

Affected systems are any installations of the modern‑tar npm package with a version between 0.3.5 and 0.8.5, inclusive. The repository owner is ayuhito, and the issue pertains to the tar/encoding.ts implementation in those releases.

The CVSS score of 8.7 reflects a high severity for a denial‑of‑service instability. No EPSS entry is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would supply a specifically crafted tar archive to the unpackTar() entry point; the vulnerability can be exploited in any context where an application relies on modern‑tar to extract data, such as HTTP uploads or filesystem package handling. No authentication or elevated privilege is required beyond the ability to supply the archive.