Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T15:25:09 node-tar: node-tar: Denial of Service due to incorrect PAX path handling 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-843

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.

A flaw was found in node-tar, a library for manipulating tar archives in Node.js. This vulnerability occurs when the library incorrectly converts specific archive path values into numbers, leading to an error during subsequent path processing. An attacker could exploit this to cause the application using node-tar to crash, resulting in a denial of service.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Confidential Compute Attestation Fix deferred openshift-sandboxed-containers/osc-pccs Cryostat 4 Fix deferred cryostat-openshift-console-plugin-npm Cryostat 4 Fix deferred grafana-infinity-datasource-npm Cryostat 4 Fix deferred tar Exploit Intelligence Fix deferred exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Containers Fix deferred rhmtc/openshift-migration-ui-rhel8 Node HealthCheck Operator Fix deferred workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Fix deferred workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Fix deferred workload-availability/node-healthcheck-rhel9-operator OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-rhel9 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp21/system Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp22/system Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/volsync-rhel9 Red Hat AMQ Broker 7 Fix deferred tar Red Hat build of Apache Camel for Spring Boot 4 Fix deferred tar Red Hat build of Apache Camel - HawtIO 4 Fix deferred tar Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Connectivity Link 1 Fix deferred rhcl-1/rhcl-console-plugin-rhel9 Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Fix deferred linux-sgx Red Hat Enterprise Linux 10 Fix deferred nodejs22 Red Hat Enterprise Linux 10 Fix deferred nodejs24 Red Hat Enterprise Linux 10 Fix deferred tar Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-22 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-22-minimal Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24-minimal Red Hat Enterprise Linux 10 Fix deferred ubi10/s2i-base Red Hat Enterprise Linux 6 Fix deferred tar Red Hat Enterprise Linux 7 Fix deferred tar Red Hat Enterprise Linux 8 Fix deferred dotnet5.0-build-reference-packages Red Hat Enterprise Linux 8 Fix deferred grafana Red Hat Enterprise Linux 8 Fix deferred grafana-pcp Red Hat Enterprise Linux 8 Fix deferred mozjs60 Red Hat Enterprise Linux 8 Fix deferred nodejs Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-22 Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-22-minimal Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24 Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24-minimal Red Hat Enterprise Linux 8 Fix deferred ubi8/s2i-base Red Hat Enterprise Linux 9 Fix deferred gjs Red Hat Enterprise Linux 9 Fix deferred linux-sgx Red Hat Enterprise Linux 9 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 9 Fix deferred tar Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-22 Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-22-minimal Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24 Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24-minimal Red Hat Enterprise Linux 9 Fix deferred ubi9/s2i-base Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Not affected yarnpkg Red Hat JBoss Enterprise Application Platform 7 Fix deferred tar Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred tar Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred rhcos Red Hat Openshift Data Foundation 4 Fix deferred odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-rhel9 Red Hat Satellite 6 Fix deferred satellite/iop-remediations-rhel9 Red Hat Single Sign-On 7 Fix deferred tar Red Hat Trusted Artifact Signer Fix deferred rhtas/rekor-search-ui-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59871 https://nvd.nist.gov/vuln/detail/CVE-2026-59871 https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b https://github.com/isaacs/node-tar/releases/tag/v7.5.18 https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp