Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-07-08T15:20:29
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-170
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
A flaw was found in node-tar, a library for manipulating tar archives in Node.js. A remote attacker could craft a malicious archive containing null characters (NUL bytes) in its metadata. When this archive is processed, the unstripped null characters can cause the application to terminate unexpectedly, leading to a Denial of Service (DoS).
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Confidential Compute Attestation
Fix deferred
openshift-sandboxed-containers/osc-pccs
Cryostat 4
Fix deferred
cryostat-openshift-console-plugin-npm
Cryostat 4
Fix deferred
grafana-infinity-datasource-npm
Cryostat 4
Fix deferred
tar
Exploit Intelligence
Fix deferred
exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
Migration Toolkit for Containers
Fix deferred
rhmtc/openshift-migration-ui-rhel8
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-rhel9-operator
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-rhel9
Red Hat 3scale API Management Platform 2
Fix deferred
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Fix deferred
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Fix deferred
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Fix deferred
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Fix deferred
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Fix deferred
rhacm2/volsync-operator-bundle
Red Hat Advanced Cluster Management for Kubernetes 2
Fix deferred
rhacm2/volsync-rhel9
Red Hat AMQ Broker 7
Fix deferred
tar
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
tar
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
tar
Red Hat Build of Podman Desktop
Fix deferred
rh-podman-desktop.git
Red Hat Connectivity Link 1
Fix deferred
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Developer Hub
Fix deferred
rhdh/rhdh-hub-rhel9
Red Hat Enterprise Linux 10
Fix deferred
linux-sgx
Red Hat Enterprise Linux 10
Fix deferred
nodejs22
Red Hat Enterprise Linux 10
Fix deferred
nodejs24
Red Hat Enterprise Linux 10
Fix deferred
tar
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-22
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-22-minimal
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-24
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-24-minimal
Red Hat Enterprise Linux 10
Fix deferred
ubi10/s2i-base
Red Hat Enterprise Linux 6
Fix deferred
tar
Red Hat Enterprise Linux 7
Fix deferred
tar
Red Hat Enterprise Linux 8
Fix deferred
dotnet5.0-build-reference-packages
Red Hat Enterprise Linux 8
Fix deferred
grafana
Red Hat Enterprise Linux 8
Fix deferred
grafana-pcp
Red Hat Enterprise Linux 8
Fix deferred
mozjs60
Red Hat Enterprise Linux 8
Fix deferred
nodejs
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-22
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-22-minimal
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-24
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-24-minimal
Red Hat Enterprise Linux 8
Fix deferred
ubi8/s2i-base
Red Hat Enterprise Linux 9
Fix deferred
gjs
Red Hat Enterprise Linux 9
Fix deferred
linux-sgx
Red Hat Enterprise Linux 9
Fix deferred
nodejs:22/nodejs
Red Hat Enterprise Linux 9
Fix deferred
nodejs:24/nodejs
Red Hat Enterprise Linux 9
Fix deferred
tar
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-22
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-22-minimal
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-24
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-24-minimal
Red Hat Enterprise Linux 9
Fix deferred
ubi9/s2i-base
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/disk-image-cuda-rhel9
Red Hat Hardened Images
Not affected
yarnpkg
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
tar
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
tar
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
rhcos
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/mcg-core-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/udi-rhel9
Red Hat Satellite 6
Fix deferred
satellite/iop-remediations-rhel9
Red Hat Single Sign-On 7
Fix deferred
tar
Red Hat Trusted Artifact Signer
Fix deferred
rhtas/rekor-search-ui-rhel9
Self-service automation portal 2
Fix deferred
ansible-automation-platform/automation-portal
Self-service automation portal 2
Fix deferred
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-59875
https://nvd.nist.gov/vuln/detail/CVE-2026-59875
https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3
https://github.com/isaacs/node-tar/releases/tag/v7.5.17
https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j