AZL-37115 CVE-2024-28863 affecting package nodejs for versions less than 20.14.0-1

🗓️ 21 Mar 2024 23:15:10Reported by GoogleType

osv

osv🔗 osv.dev👁 10 Views

node-tar allows memory exhaustion via deep subfolders in nodejs below 20.14.0-1; fixed in 6.2.1.

Reporter	Title	Published	Views	Family All 142
ibm	Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	8 Jan 202518:32	–	ibm
ibm	Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Denial of Service (DoS) due to tar	17 Dec 202510:16	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	4 Dec 202410:17	–	ibm
ibm	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in tar-6.2.0.tgz	7 Jul 202517:58	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in isaacs node-tar [CVE-2024-28863]	2 Apr 202517:28	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in isaacs node-tar [CVE-2024-28863]	2 Apr 202517:30	–	ibm
ibm	Security Bulletin: IBM Software Support mobile app is vulnerable to multiple vulnerabilities due to 3rd party software	27 Feb 202519:51	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	26 Mar 202503:49	–	ibm
ibm	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	22 Jul 202414:45	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses multiple packages which are vulnerable to multiple CVEs	8 Oct 202408:35	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-28863

21 Apr 2026 04:28Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.16.5

EPSS0.00929

SSVC

node-tar deep-subfolders memory-exhaustion affected-versions nodejs