A negative base field inside a checksum‑valid tar header triggers tar.replace in the node‑tar library to repeatedly parse the same header without advancing. This flaw results from insufficient input validation (CWE‑606) and causes an unbounded CPU consumption loop (CWE‑835). The library then stalls, potentially exhausting resources of the Node.js process that invoked replace, leading to a denial of service.

The vulnerable code path exists in all releases of the isaacs:node‑tar library older than version 7.5.18. Any Node.js application that imports this library and calls the replace function—whether directly or indirectly via other modules—is exposed. The remedy was applied in the 7.5.18 release.

Based on the description, the likely attack vector involves supplying a malicious tar archive with a negative entry size to the replace routine; exploitation is feasible by an actor that can provide such a header, and no elevated privileges are required. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation, and the vulnerability is not listed in CISA's KEV catalog. However, its CVSS score of 8.7 highlights the severity of the denial‑of‑service impact, emphasizing that an attacker could degrade or crash a target application by repeatedly invoking replace with a malicious header.