CVE-2026-59871

Published: Jul 8, 2026Modified: Jul 10, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.

Affected (1)

Products: Isaacs: Tar

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Isaacs Tar	Before 7.5.18

Related CWEs

Incorrect Type Conversion or Cast

The product does not correctly convert an object, resource, or structure from one type to a different type.

References (4)

https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b

Source: security-advisories@github.com

Patch

https://github.com/isaacs/node-tar/releases/tag/v7.5.18

Source: security-advisories@github.com

Release Notes

https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.