CVE-2026-59875
published 2026-07-08CVE-2026-59875: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.51%
43.0th percentile
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Affected
71 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp21 | system | — | — |
| 3scale-amp22 | system | — | — |
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| gnu | tar | — | — |
| gnu | tar | >= 0 < 7.5.17 | 7.5.17 |
| grafana | grafana | — | — |
| isaacs | node-tar | < 7.5.17 | 7.5.17 |
| nodejs | nodejs | — | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel8 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
ghsa·2026-07-20
CVE-2026-59875 [MEDIUM] CWE-248 node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
## Summary
`node-tar` strips trailing `NUL` bytes from long-name (`L`) and long-linkpath (`K`) GNU extended headers but does **not** apply the same sanitization to equivalent fields delivered via PAX (`x` typeflag) extended headers. A PAX record of the form `path=visible.txt\x00hidden.txt` is parsed verbatim into `entry.path` and flows into `fs.lstat()` / `fs.open()`, which Node.js core rejects with `ERR_INVALID_ARG_VALUE`. The throw originates inside an `FSReqCallback` async chain that is **not** wrapped by the consumer's `await/try-catch` around `tar.x()` — it surfaces as `uncaughtException` and terminates the process.
This is a remote denial-of-service primitive against any process that extracts attacker-suppl
VulDB
isaacs node-tar up to 7.5.16 PAX Record src/pax.ts uncaught exception
vuldb·2026-07-12·CVSS 5.3
CVE-2026-59875 [MEDIUM] isaacs node-tar up to 7.5.16 PAX Record src/pax.ts uncaught exception
A vulnerability was found in isaacs node-tar up to 7.5.16 and classified as problematic. This vulnerability affects unknown code of the file src/pax.ts of the component PAX Record Handler. Such manipulation leads to uncaught exception.
This vulnerability is referenced as CVE-2026-59875. It is possible to launch the attack remotely. No exploit is available.
Red Hat
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
vendor_redhat·2026-07-08·CVSS 5.3
CVE-2026-59875 [MEDIUM] CWE-170 node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
A flaw was found in node-tar, a library for manipulating tar archives in Node.js. A remote attacker could craft a malicious archive containing null characters (NUL bytes) in its metadata. When this archive is processed, the unstripped null characters can cause the application to terminate unexpectedly, leading to a Denial of Service (DoS).
Mitigation: Mitigation for this issue is either
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59875 yarnpkg: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 yarnpkg: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 yarnpkg: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 openbao: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 openbao: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
CVE-2026-59875 openbao: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 nodejs24: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 nodejs24: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 nodejs24: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 yarnpkg: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 yarnpkg: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
CVE-2026-59875 yarnpkg: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 kf6-breeze-icons: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 kf6-breeze-icons: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 kf6-breeze-icons: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 nodejs22: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 nodejs22: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 nodejs22: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 crow-translate: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 crow-translate: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 crow-translate: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 onnxruntime: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 onnxruntime: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 onnxruntime: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 mozjs78: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 mozjs78: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
CVE-2026-59875 mozjs78: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 kf6-breeze-icons: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 kf6-breeze-icons: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
CVE-2026-59875 kf6-breeze-icons: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 nodejs20: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 nodejs20: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 nodejs20: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 openbao: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 openbao: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 openbao: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 openvino: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 openvino: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 openvino: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 sgx-pccs: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
bugzilla·2026-07-09·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 sgx-pccs: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
CVE-2026-59875 sgx-pccs: node-tar: Denial of Service via crafted archive with NUL bytes in metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Bugzilla
CVE-2026-59875 node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
bugzilla·2026-07-08·CVSS 5.3
CVE-2026-59875 [MEDIUM] CVE-2026-59875 node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
CVE-2026-59875 node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
2026-07-08
Published