CVE-2026-109380: modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field

Q: Which deployments are exposed to this issue?

Deployments using npm/modern-tar versions 0.3.5 through 0.8.5 are affected when they pass attacker-controlled TAR archives to unpackTar(). Archives may be gzip-compressed.

Q: What does an attacker need to exploit this vulnerability?

An attacker needs to be able to supply a crafted archive for processing by unpackTar(). No privileges or user interaction are required according to the provided vector.

Q: How can teams reduce risk before updating?

Do not process untrusted archives with unpackTar() on affected versions. Restrict archive inputs to trusted sources until the affected dependency can be updated.

Q: How can I determine whether my application is affected?

Check whether the application uses npm/modern-tar version 0.3.5 through 0.8.5 and whether it invokes unpackTar() on archives that an attacker could provide. Affected processing can exhaust process memory and prevent later archive entries from being handled.

Published Oct 12, 2026

Updated

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.

Affected Software

1 affected component

npm/modern-tar>=0.3.5<=0.8.5

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using npm/modern-tar versions 0.3.5 through 0.8.5 are affected when they pass attacker-controlled TAR archives to unpackTar(). Archives may be gzip-compressed.

What does an attacker need to exploit this vulnerability?

An attacker needs to be able to supply a crafted archive for processing by unpackTar(). No privileges or user interaction are required according to the provided vector.

How can teams reduce risk before updating?

Do not process untrusted archives with unpackTar() on affected versions. Restrict archive inputs to trusted sources until the affected dependency can be updated.

How can I determine whether my application is affected?

Check whether the application uses npm/modern-tar version 0.3.5 through 0.8.5 and whether it invokes unpackTar() on archives that an attacker could provide. Affected processing can exhaust process memory and prevent later archive entries from being handled.

CVE-2026-109380: modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit this vulnerability?

How can teams reduce risk before updating?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit this vulnerability?

How can teams reduce risk before updating?

How can I determine whether my application is affected?