CVE-2026-59871
published 2026-07-08CVE-2026-59871: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.64%
50.6th percentile
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Affected
72 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp21 | system | — | — |
| 3scale-amp22 | system | — | — |
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| gnu | tar | — | — |
| gnu | tar | >= 0 < 7.5.18 | 7.5.18 |
| grafana | grafana | — | — |
| isaacs | node-tar | < 7.5.18 | 7.5.18 |
| isaacs | tar | < 7.5.18 | 7.5.18 |
| nodejs | nodejs | — | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
node-tar: node-tar: Denial of Service due to incorrect PAX path handling
vendor_redhat·2026-07-08·CVSS 5.3
CVE-2026-59871 [MEDIUM] CWE-843 node-tar: node-tar: Denial of Service due to incorrect PAX path handling
node-tar: node-tar: Denial of Service due to incorrect PAX path handling
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
A flaw was found in node-tar, a library for manipulating tar archives in Node.js. This vulnerability occurs when the library incorrectly converts specific archive path values into numbers, leading to an error during subsequent path processing. An attacker could exploit this to cause the application using node-tar to crash, resulting in a denial of service.
Mitigation: Mitigation for this issue i
GHSA
node-tar: Process crash via PAX numeric path type confusion
ghsa·2026-07-20
CVE-2026-59871 [MEDIUM] CWE-704 node-tar: Process crash via PAX numeric path type confusion
node-tar: Process crash via PAX numeric path type confusion
### Summary
A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls `.split('/')` on the numeric value. Error handlers and `strict: false` cannot intercept the crash.
### Details
In `pax.ts` line 180, `parseKV` converts PAX values matching `/^[0-9]+$/` to numbers via `+v`. This applies to all fields including `path` and `linkpath`. When a PAX header sets `path` to an all-digit string like `"12345"`, the value becomes the number `12345`.
This number flows through Header -> ReadEntry -> Unpack.CHECKPATH, where `normalizeWindowsPath(entry.path).split('/')` throws a TypeError b
VulDB
isaacs node-tar up to 7.5.17 PAX Path src/pax.ts path/linkpath path traversal
vuldb·2026-07-12·CVSS 7.5
CVE-2026-59871 [HIGH] isaacs node-tar up to 7.5.17 PAX Path src/pax.ts path/linkpath path traversal
A vulnerability described as problematic has been identified in isaacs node-tar up to 7.5.17. This affects an unknown part of the file src/pax.ts of the component PAX Path Handler. Executing a manipulation of the argument path/linkpath can lead to path traversal.
This vulnerability is handled as CVE-2026-59871. The attack can be executed remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59871 kf6-breeze-icons: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 kf6-breeze-icons: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 kf6-breeze-icons: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 crow-translate: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 crow-translate: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 crow-translate: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 yarnpkg: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 yarnpkg: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
CVE-2026-59871 yarnpkg: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 tar: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 tar: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 tar: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 openbao: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 openbao: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
CVE-2026-59871 openbao: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 nodejs20: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 nodejs20: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 nodejs20: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 openbao: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 openbao: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 openbao: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 mozjs78: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 mozjs78: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
CVE-2026-59871 mozjs78: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 nodejs22: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 nodejs22: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 nodejs22: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 yarnpkg: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 yarnpkg: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 yarnpkg: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 nodejs24: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 nodejs24: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 nodejs24: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 openvino: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 openvino: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 openvino: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 sgx-pccs: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 sgx-pccs: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 sgx-pccs: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 kf6-breeze-icons: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 kf6-breeze-icons: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
CVE-2026-59871 kf6-breeze-icons: node-tar: Denial of Service due to incorrect PAX path handling [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 onnxruntime: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 onnxruntime: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
CVE-2026-59871 onnxruntime: node-tar: Denial of Service due to incorrect PAX path handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59871 node-tar: node-tar: Denial of Service due to incorrect PAX path handling
bugzilla·2026-07-08·CVSS 5.3
CVE-2026-59871 [MEDIUM] CVE-2026-59871 node-tar: node-tar: Denial of Service due to incorrect PAX path handling
CVE-2026-59871 node-tar: node-tar: Denial of Service due to incorrect PAX path handling
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
2026-07-08
Published