node-tar CVE-2026-59874

Exploitation requires that the target Node.js application call node-tar's tar.replace on archive data an attacker can influence (e.g., an uploaded or fetched tarball); the malicious input is a tar header with a valid checksum but a negative base-256 encoded entry size. Limiting factors: applications that only extract/create archives, or that never expose tar.replace to untrusted input, are not exploitable via this path; there is no auth or user-interaction requirement per the CVSS vector (PR:N/UI:N), but the tar.replace code path and attacker-controlled archive bytes are hard prerequisites not captured by the raw vector. The impact is limited to availability (process/event-loop hang) - no data disclosure or code execution.

This is a genuine availability risk but not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores impact solely on the vulnerable system's availability (VA:H) with no confidentiality or integrity effect, consistent with the Denial Of Service tag and CWE-835 - a single crafted archive stalls the process, but no code execution or data exposure occurs. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or probable near-term exploitation; the 8.7 severity is driven by the low-complexity, unauthenticated availability hit, not by real-world exploitation signals. The practical limiter the raw vector understates is that exploitation requires the target application to invoke tar.replace specifically on attacker-influenced archive data - the AT:N/UI:N metrics do not capture this application-design precondition. Net: patch on a normal maintenance cadence, prioritizing services that process user-uploaded tarballs.

An application uses tar.replace to update entries in tar archives that users can upload (for example a package-processing or backup service). An attacker uploads a specially crafted tarball containing a header with a valid checksum but a negative base-256 encoded size; when the service scans it, the tar.replace loop spins on that header forever, consuming CPU and hanging the Node.js event loop until the process is killed. No POC was provided in the intelligence, and exploitation needs no authentication or user interaction beyond delivering the archive.