VYPR
← All advisories
Medium severity5.3OSV Advisory· Published Jul 8, 2026· Updated Jul 10, 2026

CVE-2026-59875

CVE-2026-59875

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tarnpm
< 7.5.177.5.17

Affected products

34

Patches

Vulnerability mechanics

References

5

News mentions

1