CVE-2026-59874
published 2026-07-08CVE-2026-59874: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.43%
37.4th percentile
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Affected
59 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp21 | system | — | — |
| 3scale-amp22 | system | — | — |
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| debian | python-cryptography | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| gnu | tar | — | — |
| gnu | tar | >= 0 < 7.5.18 | 7.5.18 |
| grafana | grafana | — | — |
| isaacs | node-tar | < 7.5.18 | 7.5.18 |
| isaacs | tar | < 7.5.18 | 7.5.18 |
| nodejs | nodejs | — | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
node-tar: Negative tar entry size causes infinite loop in archive replace
ghsa·2026-07-20
CVE-2026-59874 [HIGH] CWE-835 node-tar: Negative tar entry size causes infinite loop in archive replace
node-tar: Negative tar entry size causes infinite loop in archive replace
### Summary
A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service.
### Details
The public `tar.replace()` API scans the existing archive before appending replacement entries. During this scan, it parses each tar header and advances the archive position by the parsed entry size rounded to a 512-byte block boundary.
Tar supports base-256 encoded numeric fields. A crafted header can encode the entry size as `-512` while still carrying a valid checksum. The replace scan accepts that parsed negat
VulDB
isaacs node-tar up to 7.5.17 Archive Scanner replace denial of service
vuldb·2026-07-12·CVSS 7.5
CVE-2026-59874 [HIGH] isaacs node-tar up to 7.5.17 Archive Scanner replace denial of service
A vulnerability has been found in isaacs node-tar up to 7.5.17 and classified as problematic. This affects the function replace of the component Archive Scanner. This manipulation causes denial of service.
The identification of this vulnerability is CVE-2026-59874. The attack needs to be done within the local network. There is no exploit available.
Red Hat
tar: Node-tar: Denial of Service via malformed tar archive header
vendor_redhat·2026-07-08·CVSS 8.7
CVE-2026-59874 [HIGH] CWE-606 tar: Node-tar: Denial of Service via malformed tar archive header
tar: Node-tar: Denial of Service via malformed tar archive header
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affect
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59874 crow-translate: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 crow-translate: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 crow-translate: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 sgx-pccs: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 sgx-pccs: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 sgx-pccs: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 openbao: Node-tar: Denial of Service via malformed tar archive header [epel-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 openbao: Node-tar: Denial of Service via malformed tar archive header [epel-all]
CVE-2026-59874 openbao: Node-tar: Denial of Service via malformed tar archive header [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 yarnpkg: Node-tar: Denial of Service via malformed tar archive header [epel-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 yarnpkg: Node-tar: Denial of Service via malformed tar archive header [epel-all]
CVE-2026-59874 yarnpkg: Node-tar: Denial of Service via malformed tar archive header [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 kf6-breeze-icons: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 kf6-breeze-icons: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 kf6-breeze-icons: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 nodejs22: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 nodejs22: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 nodejs22: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 kf6-breeze-icons: Node-tar: Denial of Service via malformed tar archive header [epel-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 kf6-breeze-icons: Node-tar: Denial of Service via malformed tar archive header [epel-all]
CVE-2026-59874 kf6-breeze-icons: Node-tar: Denial of Service via malformed tar archive header [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 onnxruntime: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 onnxruntime: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 onnxruntime: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 openbao: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 openbao: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 openbao: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 nodejs24: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 nodejs24: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 nodejs24: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 mozjs78: Node-tar: Denial of Service via malformed tar archive header [epel-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 mozjs78: Node-tar: Denial of Service via malformed tar archive header [epel-all]
CVE-2026-59874 mozjs78: Node-tar: Denial of Service via malformed tar archive header [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 yarnpkg: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 yarnpkg: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 yarnpkg: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 nodejs20: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 nodejs20: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 nodejs20: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 openvino: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
bugzilla·2026-07-09·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 openvino: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
CVE-2026-59874 openvino: Node-tar: Denial of Service via malformed tar archive header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Bugzilla
CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header
bugzilla·2026-07-08·CVSS 8.7
CVE-2026-59874 [HIGH] CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header
CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
2026-07-08
Published