node-tar, a tar manipulation library for Node.js, does not enforce bounds on the total size of decompressed data, the number of entries, or the compression ratio during extraction or parsing. This flaw allows an attacker to craft a gzip bomb that consumes excessive disk space and CPU cycles, resulting in denial of service for the application or host system. The vulnerability is a classic resource exhaustion issue (CWE-770).

Any deployment that uses isaacs' node-tar library at a version earlier than 7.5.19 is affected. Projects, web applications, or services that process user‑supplied tar or gzip archives with an old node-tar dependency are at risk.

The CVSS score of 9.2 indicates a severe threat, while the EPSS score of less than 1 % shows that exploitation is not common yet. The vulnerability is listed outside the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw by delivering a crafted archive to the target application, potentially remotely if the application accepts uploads. Even a local adversary who controls the process can trigger the denial of service. The lack of limits means the attack can scale to consume large amounts of disk space and CPU, potentially bringing the system or the affected service down for legitimate users.