Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-08T15:23:47 tar: Node-tar: Denial of Service via malformed tar archive header 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-606

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.

This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 2026-07-29T00:00:00Z RHSA-2026:48033 nodejs22-1:22.23.1-4.el10_2 Red Hat Enterprise Linux 10 2026-07-29T00:00:00Z RHSA-2026:48034 nodejs24-1:24.18.0-3.el10_2 Red Hat Enterprise Linux 8 2026-07-28T00:00:00Z RHSA-2026:47059 nodejs:22-8100020260724100938.6d880403 Red Hat Enterprise Linux 8 2026-07-28T00:00:00Z RHSA-2026:47060 nodejs:24-8100020260724132848.6d880403 Red Hat Ansible Automation Platform 2.2 2026-07-21T00:00:00Z RHSA-2026:42815 ansible-automation-platform/automation-portal:1784622951 Red Hat OpenShift Dev Spaces 3.29 2026-07-29T00:00:00Z RHSA-2026:48124 devspaces/dashboard-rhel9:1784737150 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-pccs Cryostat 4 Not affected cryostat-openshift-console-plugin-npm Cryostat 4 Not affected grafana-infinity-datasource-npm Cryostat 4 Not affected tar Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Node HealthCheck Operator Affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Affected workload-availability/node-healthcheck-rhel9-operator OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-rhel9 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp21/system Red Hat 3scale API Management Platform 2 Not affected 3scale-amp22/system Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Will not fix 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-rhel9 Red Hat AMQ Broker 7 Affected tar Red Hat build of Apache Camel for Spring Boot 4 Not affected tar Red Hat build of Apache Camel - HawtIO 4 Affected tar Red Hat Build of Podman Desktop Affected rh-podman-desktop.git Red Hat Connectivity Link 1 Affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Affected linux-sgx Red Hat Enterprise Linux 10 Not affected tar Red Hat Enterprise Linux 6 Not affected tar Red Hat Enterprise Linux 7 Not affected tar Red Hat Enterprise Linux 8 Not affected dotnet5.0-build-reference-packages Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Not affected grafana-pcp Red Hat Enterprise Linux 8 Affected mozjs60 Red Hat Enterprise Linux 9 Affected gjs Red Hat Enterprise Linux 9 Affected linux-sgx Red Hat Enterprise Linux 9 Affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Not affected tar Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Affected aardvark-dns Red Hat Hardened Images Affected chunkah Red Hat Hardened Images Affected netavark Red Hat Hardened Images Affected python-cryptography Red Hat Hardened Images Affected rust Red Hat Hardened Images Affected rust-rpm-sequoia Red Hat Hardened Images Affected tar Red Hat Hardened Images Affected yarnpkg Red Hat JBoss Enterprise Application Platform 7 Not affected tar Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected tar Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Affected rhcos Red Hat Openshift Data Foundation 4 Affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/udi-rhel9 Red Hat Satellite 6 Affected satellite/iop-remediations-rhel9 Red Hat Single Sign-On 7 Affected tar Red Hat Trusted Artifact Signer Affected rhtas/rekor-search-ui-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59874 https://nvd.nist.gov/vuln/detail/CVE-2026-59874 https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5 https://github.com/isaacs/node-tar/releases/tag/v7.5.18 https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w