AIKIDO-2026-986821

TL;DR

The vulnerability stems from the library lacking hard upper bounds on total decompressed data volume, entry counts, or decompression ratios. During extraction, the Unpack stream in src/extract.ts blindly processes incoming entries without tracking global resource consumption. Because existing limits like the maxReadSize option only govern internal read chunk sizes rather than cumulative disk writes, an attacker can forge a TAR header claiming a massive file size backed by highly compressible data. The library will continuously unpack and write this payload, lacking any mechanism to abort, until the physical storage of the host is completely exhausted and the service crashes.