CVE-2026-59871: medium-severity vulnerability in isaacs node-tar
node-tar: Process crash via PAX numeric path type confusion
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
isaacs · node-tarRelated CVEs — isaacs node-tar
In the same product, most dangerous first.
CVE-2024-28863MEDIUMnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationEPSS 0.9%CVE-2026-24842HIGHnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalEPSS 0.6%CVE-2026-59873CRITICALnode-tar: Decompression/parse DoS via unlimited inputEPSS 0.6%CVE-2026-73566HIGHnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionEPSS 0.5%CVE-2026-29786HIGHnode-tar: Hardlink Path Traversal via Drive-Relative LinkpathEPSS 0.5%CVE-2026-59874HIGHnode-tar: Negative tar entry size causes infinite loop in archive replaceEPSS 0.4%