{"id":"CVE-2026-59871","aliases":["CLSA-2026-1784596283","CLSA-2026-1792074268","CLSA-2026-1792074305","CLSA-2026-1792164559","CLSA-2026-1793101936","CLSA-2026-1793102032","CLSA-2026-1793307830","DEBIAN-CVE-2026-59871","EUVD-2026-42308","GHSA-r292-9mhp-454m","GHSA-w8wr-v893-vjvp","ROOT-APP-NPM-CVE-2026-59871","UBUNTU-CVE-2026-59871"],"status":"published","title":"node-tar: Process crash via PAX numeric path type confusion","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00644,"percentile":0.5116,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-704"],"published":"2026-07-08T15:25:09Z","modified":"2026-10-30T02:15:07Z","fixes":[{"ecosystem":"npm","package":"tar","fixed_in":["7.5.18"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-tar","fixed_in":["7.5.19+~4.0.1-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar","fixed_in":["6.1.11-aikido.10","7.5.11-aikido.4","7.5.1-aikido.12","6.1.11-aikido.8","7.5.17-aikido.1","4.4.19-aikido.5","6.2.1-aikido.11","7.5.15-aikido.2","7.5.16-aikido.1","7.5.17-aikido.2","6.1.11-aikido.9","4.4.19-aikido.6","7.4.3-aikido.10","7.5.15-aikido.3","7.5.1-aikido.11","7.5.13-aikido.2","7.5.9-aikido.3","7.5.9-aikido.4","7.5.9-aikido.5","7.5.15-aikido.4","4.4.19-aikido.7","6.2.1-aikido.12","7.5.9-aikido.6","7.5.16-aikido.2","7.4.3-aikido.11","7.5.13-aikido.3","7.4.3-aikido.12"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar","fixed_in":["6.1.11-root.io.10","7.5.11-root.io.4","7.5.1-root.io.12","6.1.11-root.io.8","7.5.17-root.io.1","4.4.19-root.io.5","6.2.1-root.io.11","7.5.15-root.io.2","7.5.16-root.io.1","7.5.17-root.io.2","6.1.11-root.io.9","4.4.19-root.io.6","7.4.3-root.io.10","7.5.15-root.io.3","7.5.1-root.io.11","7.5.13-root.io.2","7.5.9-root.io.3","7.5.9-root.io.4","7.5.9-root.io.5","7.5.15-root.io.4","4.4.19-root.io.7","6.2.1-root.io.12","7.5.9-root.io.6","7.5.16-root.io.2","7.4.3-root.io.11","7.5.13-root.io.3","7.4.3-root.io.12"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.5.17"},{"fixed":"7.5.18"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1-tuxcare.0"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0-tuxcare.0"},{"fixed":"6.2.0-tuxcare.5"}]}],"versions":["6.2.0","6.2.0-tuxcare.1","6.2.0-tuxcare.2","6.2.0-tuxcare.3","6.2.0-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2-tuxcare.0"},{"fixed":"6.0.2-tuxcare.6"}]}],"versions":["6.0.2","6.0.2-tuxcare.1","6.0.2-tuxcare.2","6.0.2-tuxcare.3","6.0.2-tuxcare.4","6.0.2-tuxcare.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.17-tuxcare.0"},{"fixed":"7.5.17-tuxcare.1"}]}],"versions":["7.5.17"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0-tuxcare.0"},{"fixed":"6.1.0-tuxcare.3"}]}],"versions":["6.1.0","6.1.0-tuxcare.1","6.1.0-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6-tuxcare.0"},{"fixed":"6.1.6-tuxcare.2"}]}],"versions":["6.1.6","6.1.6-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.19-tuxcare.0"},{"fixed":"4.4.19-tuxcare.5"}]}],"versions":["4.4.19","4.4.19-tuxcare.1","4.4.19-tuxcare.2","4.4.19-tuxcare.3","4.4.19-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.13+~cs7.0.5-1","6.1.13+~cs7.0.5-1+deb12u1","6.1.13+~cs7.0.5-2","6.1.13+~cs7.0.5-3","6.1.13+~cs7.0.5-4","6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-10","6.2.1+ds1+~cs6.1.13-11","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-8","6.2.1+ds1+~cs6.1.13-9","6.2.1+~cs7.0.8-1","7.5.16+~4.0.1-1","7.5.16+~4.0.1-2","7.5.19+~4.0.1-1","7.5.19+~4.0.1-2","7.5.22+~4.0.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-10","6.2.1+ds1+~cs6.1.13-11","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-8","6.2.1+ds1+~cs6.1.13-9","6.2.1+~cs7.0.8-1","6.2.1+~cs7.0.8-1+deb13u1","7.5.16+~4.0.1-1","7.5.16+~4.0.1-2","7.5.19+~4.0.1-1","7.5.19+~4.0.1-2","7.5.22+~4.0.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.19+~4.0.1-1"}]}],"versions":["6.2.1+ds1+~cs6.1.13-1","6.2.1+ds1+~cs6.1.13-10","6.2.1+ds1+~cs6.1.13-11","6.2.1+ds1+~cs6.1.13-2","6.2.1+ds1+~cs6.1.13-3","6.2.1+ds1+~cs6.1.13-4","6.2.1+ds1+~cs6.1.13-5","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-8","6.2.1+ds1+~cs6.1.13-9","6.2.1+~cs7.0.8-1","7.5.16+~4.0.1-1","7.5.16+~4.0.1-2"]},{"source":"osv","ecosystem":"npm","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.18"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.11-aikido.10"},{"fixed":"7.5.11-aikido.4"},{"fixed":"7.5.1-aikido.12"},{"fixed":"6.1.11-aikido.8"},{"fixed":"7.5.17-aikido.1"},{"fixed":"4.4.19-aikido.5"},{"fixed":"6.2.1-aikido.11"},{"fixed":"7.5.15-aikido.2"},{"fixed":"7.5.16-aikido.1"},{"fixed":"7.5.17-aikido.2"},{"fixed":"6.1.11-aikido.9"},{"fixed":"4.4.19-aikido.6"},{"fixed":"7.4.3-aikido.10"},{"fixed":"7.5.15-aikido.3"},{"fixed":"7.5.1-aikido.11"},{"fixed":"7.5.13-aikido.2"},{"fixed":"7.5.9-aikido.3"},{"fixed":"7.5.9-aikido.4"},{"fixed":"7.5.9-aikido.5"},{"fixed":"7.5.15-aikido.4"},{"fixed":"4.4.19-aikido.7"},{"fixed":"6.2.1-aikido.12"},{"fixed":"7.5.9-aikido.6"},{"fixed":"7.5.16-aikido.2"},{"fixed":"7.4.3-aikido.11"},{"fixed":"7.5.13-aikido.3"},{"fixed":"7.4.3-aikido.12"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.11-root.io.10"},{"fixed":"7.5.11-root.io.4"},{"fixed":"7.5.1-root.io.12"},{"fixed":"6.1.11-root.io.8"},{"fixed":"7.5.17-root.io.1"},{"fixed":"4.4.19-root.io.5"},{"fixed":"6.2.1-root.io.11"},{"fixed":"7.5.15-root.io.2"},{"fixed":"7.5.16-root.io.1"},{"fixed":"7.5.17-root.io.2"},{"fixed":"6.1.11-root.io.9"},{"fixed":"4.4.19-root.io.6"},{"fixed":"7.4.3-root.io.10"},{"fixed":"7.5.15-root.io.3"},{"fixed":"7.5.1-root.io.11"},{"fixed":"7.5.13-root.io.2"},{"fixed":"7.5.9-root.io.3"},{"fixed":"7.5.9-root.io.4"},{"fixed":"7.5.9-root.io.5"},{"fixed":"7.5.15-root.io.4"},{"fixed":"4.4.19-root.io.7"},{"fixed":"6.2.1-root.io.12"},{"fixed":"7.5.9-root.io.6"},{"fixed":"7.5.16-root.io.2"},{"fixed":"7.4.3-root.io.11"},{"fixed":"7.5.13-root.io.3"},{"fixed":"7.4.3-root.io.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.18-1","0.1.18-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-2","1.0.3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.10+ds1-2","4.4.10+ds1-2ubuntu1","4.4.10+ds1-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.7+~cs11.3.10-1","6.1.11+~cs11.3.10-1","6.1.11+ds1+~cs6.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.13+~cs7.0.5-1","6.1.13+~cs7.0.5-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+ds1+~cs6.1.13-10","7.5.22+~4.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1+~cs7.0.8-1","6.2.1+ds1+~cs6.1.13-6","6.2.1+ds1+~cs6.1.13-7","6.2.1+ds1+~cs6.1.13-10"]}],"products":[{"vendor":"isaacs","product":"node-tar"},{"vendor":"isaacs","product":"tar"}],"references":[{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w8wr-v893-vjvp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59871.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59871","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-59871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59871","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59871","title":"node-tar: Process crash via PAX numeric path type confusion","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","status":"published","published":"2026-07-08T15:25:09.519Z","modified":"2026-07-08T16:13:05.563Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-42308","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","status":"published","published":"2026-07-08T15:25:09Z","modified":"2026-07-08T16:13:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:10.578977Z"}],"ghsa":[{"id":"GHSA-w8wr-v893-vjvp","title":"node-tar: Process crash via PAX numeric path type confusion","description":"### Summary\n\nA crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls `.split('/')` on the numeric value. Error handlers and `strict: false` cannot intercept the crash.\n\n### Details\n\nIn `pax.ts` line 180, `parseKV` converts PAX values matching `/^[0-9]+$/` to numbers via `+v`. This applies to all fields including `path` and `linkpath`. When a PAX header sets `path` to an all-digit string like `\"12345\"`, the value becomes the number `12345`.\n\nThis number flows through Header -\u003e ReadEntry -\u003e Unpack.CHECKPATH, where `normalizeWindowsPath(entry.path).split('/')` throws a TypeError because numbers don't have `.split()`.\n\nThe throw is synchronous during event emission and bypasses all error handling:\n- `strict: false` does not help\n- `'error'` event handlers do not catch it\n- `'warn'` handlers do not catch it\n- The TypeError propagates through the event emitter stack as an uncaughtException\n\nDirectory, SymbolicLink, and Link type entries reach CHECKPATH and crash. File type entries crash earlier in Header constructor at `this.path.slice(-1)`, but that throw is caught and emitted as a warning only.\n\n### PoC\n\nCreate a tar archive with a PAX extended header containing an all-digit path:\n\n```\nPAX header body: \"18 path=12345\\n\"\nEntry type: Directory (type '5')\n```\n\nExtract it:\n```js\nconst tar = require('tar');\n\n// All of these crash with TypeError: t.split is not a function\ntar.extract({ file: 'malicious.tar', cwd: '/tmp/test' });\n\n// Error handlers don't help:\ntar.extract({ file: 'malicious.tar', cwd: '/tmp/test', strict: false })\n  .on('error', (err) =\u003e { /* never reached */ })\n  .on('warn', (code, msg) =\u003e { /* never reached */ });\n```\n\nThe archive is ~2.5KB. The crash is deterministic on every attempt.\n\n### Impact\n\nDenial of service. Any application or tool that extracts untrusted tar archives crashes from a single small file. This includes npm (which uses node-tar to extract packages), CI/CD pipelines, file upload processors, and backup tools. The crash cannot be caught by application-level error handling.","status":"published","published":"2026-07-20T21:53:14Z","modified":"2026-07-20T21:53:15Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:40:48.410776Z"}],"nvd":[{"id":"CVE-2026-59871","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","status":"published","published":"2026-07-08T16:16:33.723Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-59871","title":"node-tar: Process crash via PAX numeric path type confusion","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","status":"published","published":"2026-07-08T15:25:09.519Z","modified":"2026-10-28T02:31:12.956101719Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59871","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","status":"published","published":"2026-07-08T16:16:33.723Z","modified":"2026-10-26T11:47:39.467361608Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-w8wr-v893-vjvp","title":"node-tar: Process crash via PAX numeric path type confusion","description":"### Summary\n\nA crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls `.split('/')` on the numeric value. Error handlers and `strict: false` cannot intercept the crash.\n\n### Details\n\nIn `pax.ts` line 180, `parseKV` converts PAX values matching `/^[0-9]+$/` to numbers via `+v`. This applies to all fields including `path` and `linkpath`. When a PAX header sets `path` to an all-digit string like `\"12345\"`, the value becomes the number `12345`.\n\nThis number flows through Header -\u003e ReadEntry -\u003e Unpack.CHECKPATH, where `normalizeWindowsPath(entry.path).split('/')` throws a TypeError because numbers don't have `.split()`.\n\nThe throw is synchronous during event emission and bypasses all error handling:\n- `strict: false` does not help\n- `'error'` event handlers do not catch it\n- `'warn'` handlers do not catch it\n- The TypeError propagates through the event emitter stack as an uncaughtException\n\nDirectory, SymbolicLink, and Link type entries reach CHECKPATH and crash. File type entries crash earlier in Header constructor at `this.path.slice(-1)`, but that throw is caught and emitted as a warning only.\n\n### PoC\n\nCreate a tar archive with a PAX extended header containing an all-digit path:\n\n```\nPAX header body: \"18 path=12345\\n\"\nEntry type: Directory (type '5')\n```\n\nExtract it:\n```js\nconst tar = require('tar');\n\n// All of these crash with TypeError: t.split is not a function\ntar.extract({ file: 'malicious.tar', cwd: '/tmp/test' });\n\n// Error handlers don't help:\ntar.extract({ file: 'malicious.tar', cwd: '/tmp/test', strict: false })\n  .on('error', (err) =\u003e { /* never reached */ })\n  .on('warn', (code, msg) =\u003e { /* never reached */ });\n```\n\nThe archive is ~2.5KB. The crash is deterministic on every attempt.\n\n### Impact\n\nDenial of service. Any application or tool that extracts untrusted tar archives crashes from a single small file. This includes npm (which uses node-tar to extract packages), CI/CD pipelines, file upload processors, and backup tools. The crash cannot be caught by application-level error handling.","status":"published","published":"2026-07-20T21:53:14Z","modified":"2026-09-10T03:51:12.362978491Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"UBUNTU-CVE-2026-59871","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","status":"published","published":"2026-07-08T16:16:00Z","modified":"2026-10-17T13:00:29.323436171Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1784596283","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 6.2.1-tuxcare.4.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:52.713551156Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792074268","title":"TuxCare security update for tar (8 CVEs)","description":"TuxCare rebuilt tar to address 8 CVEs. Fixed in 6.2.0-tuxcare.5.","status":"published","published":"2026-10-15T14:24:28Z","modified":"2026-10-16T19:13:10.687653114Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792074305","title":"TuxCare security update for tar (12 CVEs)","description":"TuxCare rebuilt tar to address 12 CVEs. Fixed in 6.0.2-tuxcare.6.","status":"published","published":"2026-10-15T14:25:05Z","modified":"2026-10-15T19:00:02.575217399Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792164559","title":"TuxCare security update for tar (2 CVEs)","description":"TuxCare rebuilt tar to address 2 CVEs. Fixed in 7.5.17-tuxcare.1.","status":"published","published":"2026-10-16T15:29:19Z","modified":"2026-10-16T16:30:46.812027043Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1793101936","title":"TuxCare security update for tar (6 CVEs)","description":"TuxCare rebuilt tar to address 6 CVEs. Fixed in 6.1.0-tuxcare.3.","status":"published","published":"2026-10-27T11:52:16Z","modified":"2026-10-27T13:30:14.525678692Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102032","title":"TuxCare security update for tar (5 CVEs)","description":"TuxCare rebuilt tar to address 5 CVEs. Fixed in 6.1.6-tuxcare.2.","status":"published","published":"2026-10-27T11:53:52Z","modified":"2026-10-27T13:30:14.828323058Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793307830","title":"TuxCare security update for tar (11 CVEs)","description":"TuxCare rebuilt tar to address 11 CVEs. Fixed in 4.4.19-tuxcare.5.","status":"published","published":"2026-10-29T22:03:51Z","modified":"2026-10-30T02:15:07.69312809Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"ROOT-APP-NPM-CVE-2026-59871","title":"CVE-2026-59871 in tar - Patched by Root","description":"Root has patched CVE-2026-59871 in the tar package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-25T08:27:39Z","modified":"2026-09-25T09:15:05.159353348Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}