Vulnerability Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5
- https://github.com/isaacs/node-tar/releases/tag/v7.5.17
- https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j
- https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j
FAQ
What is CVE-2026-59875?
CVE-2026-59875 is a vulnerability with a CVSS score of 5.3 (MEDIUM). node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values ...
How severe is CVE-2026-59875?
CVE-2026-59875 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59875?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.