High severity7.5OSV Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-59874
CVE-2026-59874
Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tarnpm | < 7.5.18 | 7.5.18 |
Affected products
58- osv-coords55 versionspkg:apk/chainguard/code-serverpkg:apk/chainguard/gitlab-rails-ce-fips-19.2pkg:apk/chainguard/gitlab-rails-ce-18.1pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-19.1pkg:apk/chainguard/gitlab-rails-ce-fips-18.1pkg:apk/chainguard/graalvm-25-ce-nodejspkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kubeflow-centraldashboardpkg:apk/chainguard/lernapkg:apk/chainguard/opensearch-dashboards-2-fipspkg:apk/chainguard/pulumi-language-nodejspkg:apk/chainguard/safpkg:apk/chainguard/tensorflow-gpu-jupyterpkg:apk/wolfi/code-serverpkg:apk/wolfi/kubeflow-centraldashboardpkg:apk/wolfi/prismpkg:apk/wolfi/pulumi-language-nodejspkg:apk/wolfi/sqlpadpkg:apk/chainguard/actions-runnerpkg:apk/chainguard/gitlab-rails-ce-19.2pkg:apk/chainguard/gitlab-rails-ce-fips-19.0pkg:apk/chainguard/gitlab-rails-ce-fips-19.1pkg:apk/chainguard/homepagepkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/opensearch-dashboards-2pkg:apk/chainguard/prismpkg:apk/chainguard/sqlpadpkg:apk/chainguard/wazuh-dashboardpkg:apk/chainguard/wazuh-dashboard-fipspkg:apk/wolfi/lernapkg:apk/wolfi/npmpkg:apk/wolfi/safpkg:apk/chainguard/npmpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/v8-13.6-develpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-libs
< 4.129.0-r1+ 54 more
- (no CPE)range: < 4.129.0-r1
- (no CPE)range: < 19.2.1-r4
- (no CPE)range: < 18.1.6-r31
- (no CPE)range: < 19.0.4-r10
- (no CPE)range: < 19.1.2-r8
- (no CPE)range: < 18.1.6-r61
- (no CPE)range: < 25.0.4-r2
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 1.10.0-r25
- (no CPE)range: < 9.0.7-r11
- (no CPE)range: < 2.19.5-r18
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 1.6.0-r3
- (no CPE)range: < 0
- (no CPE)range: < 4.129.0-r1
- (no CPE)range: < 1.10.0-r25
- (no CPE)range: < 5.16.0-r1
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 7.5.7-r29
- (no CPE)range: < 2.336.0-r1
- (no CPE)range: < 19.2.2-r2
- (no CPE)range: < 19.0.4-r7
- (no CPE)range: < 19.1.2-r9
- (no CPE)range: < 1.13.2-r5
- (no CPE)range: < 9.2.8-r17
- (no CPE)range: < 9.2.8-r17
- (no CPE)range: < 2.19.6-r4
- (no CPE)range: < 5.16.0-r1
- (no CPE)range: < 7.5.7-r29
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r4
- (no CPE)range: < 9.0.7-r11
- (no CPE)range: < 12.0.0-r1
- (no CPE)range: < 1.6.0-r3
- (no CPE)range: < 12.0.0-r1
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 3.1.14-2.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:11.16.0-1.24.18.0.3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251
- (no CPE)range: < 1:10.9.8-1.22.23.1.4.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:11.16.0-1.24.18.0.3.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
Patches
Vulnerability mechanics
References
5- github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5nvdPatchWEB
- github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5wnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-8x88-c5mf-7j5wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59874ghsaADVISORY
- github.com/isaacs/node-tar/releases/tag/v7.5.18nvdRelease NotesWEB
News mentions
1- Node Tar: Four Archive Handling Flaws Patched in Same-Day DisclosureVypr Intelligence · Jul 9, 2026