Skip to main content

node-tar CVE-2026-59874

| EUVDEUVD-2026-42306 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-08 GitHub_M GHSA-8x88-c5mf-7j5w
Denial Of Service Node.js Red Hat Suse Node Tar Isaacs
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Attacker-supplied archive reaches the scanner over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is a process hang only, so A:H with C:N/I:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 08, 2026 - 17:01 EUVD
Analysis Generated
Jul 08, 2026 - 16:24 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 10 npm packages depend on tar (6 direct, 4 indirect)

Ecosystem-wide dependent count for version 7.5.18.

DescriptionCVE.org

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

Articles & Coverage 1

News 5 New Node.js Vulnerabilities - 1 Critical, 4 High Severity Jul 09, 2026

AnalysisAI

Denial of service in node-tar prior to 7.5.18 allows remote attackers to hang a Node.js application by feeding it a crafted tar archive: a checksum-valid header carrying a negative base-256 encoded entry size makes the tar.replace scanner advance zero bytes and re-parse the same header forever. No public exploit or active exploitation is identified at time of analysis, but the CVSS 4.0 base score of 8.7 reflects the high, easily-reachable availability impact. Only applications that call tar.replace on untrusted archive input are affected.

Technical ContextAI

node-tar (the isaacs/node-tar package, CPE cpe:2.3:a:isaacs:node-tar) is the de-facto tar implementation for the Node.js ecosystem and is bundled as a dependency of npm itself. The tar format encodes each entry's size in an octal or, for large values, a base-256 field within the 512-byte header. The tar.replace API scans an existing archive header-by-header, using the parsed entry size to compute how far to advance to the next header. The root cause is CWE-835 (Loop with Unreachable Exit Condition / infinite loop): the scanner trusts a header whose checksum validates but whose base-256 size decodes to a negative value, so the computed forward offset is zero (or negative), the read pointer never moves past the malicious header, and the same header is parsed indefinitely, pinning the event loop.

RemediationAI

Vendor-released patch: node-tar 7.5.18 - upgrade the direct or transitive dependency to 7.5.18 or later (npm install tar@^7.5.18, and run npm audit / update lockfiles to pull the fix into transitive uses). The corrective commit is https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5 and the advisory is https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w. Where an immediate upgrade is not possible, the concrete compensating control is to avoid calling tar.replace on untrusted or externally-sourced archives, routing untrusted tarballs through a re-created archive or a size/timeout-bounded extraction path instead; the trade-off is reduced in-place update functionality for affected workflows. Additionally, run archive-processing work in a worker thread or child process with a wall-clock timeout so an infinite-loop input kills only that worker rather than the main event loop, at the cost of some added operational complexity.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected

Share

CVE-2026-59874 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy